Short answers for serious AI security decisions.

AI agent security is the practice of constraining and validating an AI system that can use context, identities, tools, APIs, memory, or workflow automation to produce business effects. It focuses on authority, tool use, data access, approvals, runtime evidence, and operational ownership.

Traditional application security still matters, but agentic systems add a reasoning and orchestration layer that can choose tools, interpret context, and combine allowed actions in unexpected ways. Security review must therefore cover the full path from input and retrieved context to tool call, control decision, business action, and evidence.

Prompt injection is an attempt to manipulate a model or agent with crafted instructions. In enterprise workflows, the impact depends on what the agent can access or do after accepting the instruction.

Indirect prompt injection occurs when malicious instructions are hidden in content the agent later reads, such as a document, webpage, email, ticket, repository, or tool response. It is especially important for agents that retrieve or summarize untrusted content.

No. Guardrails can reduce some unsafe outputs or behaviors, but red teaming tests whether the complete workflow remains controlled under realistic pressure. It should exercise retrieved context, tools, identity, approvals, logs, failure modes, and business impact.

Human approval is most important when an action is high-impact, irreversible, customer-facing, regulated, financially meaningful, or likely to affect access, records, commitments, or operational state. Approval should be backed by clear evidence and deterministic enforcement, not only a model-generated summary.

Useful evidence usually includes the workflow in scope, relevant input or reference identifiers, selected tool, authorization result, approval decision, action taken, owner, timestamp, and control outcome. Evidence design should avoid unnecessary sensitive data collection.

Retesting should follow material changes such as a new tool, expanded permission, new sensitive data source, changed retrieval pipeline, altered approval logic, model update, or increased autonomy. Stable regression tests should be supplemented with scenario-based assessment.