AI agent security: guardrails, egress rules and audit

Instructions such as “never delete anything” are requests to a model, not rules. A well-crafted message in the agent’s input can talk the model out of them, and models also simply make mistakes. Write good instructions, but enforce every rule that matters somewhere the model cannot reach: in permissions, approvals, network rules, limits and logs.

Each risk has a control that works whatever the model decides. This is how MyDeepAgents answers each one:

• Prompt injection

  Control

  Treat outside content as data; ask before writes

  In MyDeepAgents

  Tool results reach the model marked as data, not instructions; any tool can be set to ask a person first

• Too much access

  Control

  Least privilege

  In MyDeepAgents

  Each agent gets only the tools listed for it; cloud connections start read-only, and database writes stay off until allowed

• Data leaks

  Control

  Redaction and topic limits

  In MyDeepAgents

  Card numbers are always masked before the model; optional redaction of emails, phone numbers, IBANs, US Social Security numbers and IP addresses; optional blocked topics

• Requests to internal systems

  Control

  Egress rules

  In MyDeepAgents

  HTTPS only, private and reserved addresses refused, each connector limited to its own hosts

• Runaway runs

  Control

  Limits and budgets

  In MyDeepAgents

  Caps on model calls, active time and cost for every run, plus organization and workspace budgets

• Changed tools

  Control

  Pinning

  In MyDeepAgents

  MCP tools and outside agents’ cards are pinned by a hash and stop when they change, until a person reviews them

• No record

  Control

  Audit

  In MyDeepAgents

  An audit log the application can add to but never change

The personal data redaction swaps each value for a placeholder before the model sees it and puts the real value back afterwards, outside the model’s view. Detection is pattern-based and best effort: it lowers exposure, it is not a guarantee, which is why it sits beside approvals and limits rather than replacing them.

Egress rules decide where outbound connections may go. An agent that can call an HTTP tool or an outside server could otherwise be steered to your cloud’s internal metadata service or to a private network.

In MyDeepAgents every outbound call, from connectors, MCP servers, outside agents and workflow HTTP steps alike, passes the same checks in code:

• HTTPS only, on port 443 unless a connector’s own server needs another port, and never on ports such as SSH, mail or database ports.
• A raw IP address as the host is refused.
• The host name is resolved once. If any of its addresses is private or reserved, the call is refused; otherwise the connection goes to the address that was checked, so a DNS answer cannot change between the check and the call.
• Redirects are checked again at each hop, three at most.
• Each connector reaches only its own hosts, the generic HTTP connector only the hosts you list, and a tenant can narrow the allowed hosts further.

An audit trail should answer who did what, when, on whose behalf, and whether it was allowed. In MyDeepAgents each audit entry records the actor, the tenant, any delegation in use, the action, the resource, the decision (allowed, refused by permissions or refused by policy), the reason, and the address and browser it came from. When something is changed, the entry names the fields, not their values.

The application can add audit entries and read them, but the database does not let it change or delete them. Entries can be exported as CSV, and the export is audited too. Each run also keeps its own record: every model call with its tokens and cost, and every tool call with its input and output, stored encrypted. Operational logs carry no customer content.

Each MyDeepAgents agent runs under one of three profiles: Standard, Privacy or HIPAA. The profile adds rules on top of everything above.

• Privacy: website chats show a consent notice, notifications carry links instead of content, and webhooks that only check a static token are refused.
• HIPAA: agents use only models on routes covered by a business associate agreement, which today are Claude models on Amazon Bedrock; every read of a person’s content is audited; console sign-in needs multi-factor authentication without text-message codes; and website chats need a signed-in visitor before tools that handle health data.

A profile is a set of technical rules, not a certificate. If you plan to process health data, talk to us first, so the right agreements are in place.

1. 1Give each agent only the tools it needs, and read-only access where that is enough.
2. 2Set approvals on every action that changes data others will see or that is hard to undo.
3. 3Keep credentials in the platform’s vault, never in instructions.
4. 4Set limits on steps, time and cost for every agent, and budgets for every team.
5. 5Restrict outbound calls to known hosts.
6. 6Pin outside tools and agents, and review changes before trusting them again.
7. 7Read the audit log and real runs regularly, especially in the first weeks.