An AI agent should be treated as an application component with privileged capabilities, not as an untrusted chatbot with a nicer interface. The security model therefore starts with identity and authorization.
Tool calls should be explicit, scoped, logged, and subject to policy. Sensitive data should cross clear trust boundaries. Prompts and retrieved documents should be treated as inputs that can contain hostile instructions. High-impact actions should have deterministic validation and, where appropriate, human approval.
The strongest architecture makes unsafe behavior difficult by construction: short-lived credentials, least privilege, typed tool contracts, bounded retrieval, policy checks, audit trails, and evaluation against adversarial cases.