The AI Agent Security Checklist

Use this checklist before deploying AI agents to production.

Pre-Deployment Checklist

Authentication & Authorization

• [ ] Each agent has unique credentials
• [ ] Tokens have expiration dates
• [ ] Permissions follow least privilege
• [ ] Policies are version controlled

Runtime Security

• [ ] All actions validated at runtime
• [ ] Rate limits configured
• [ ] IP restrictions (if applicable)
• [ ] Circuit breakers enabled

Monitoring & Logging

• [ ] Audit logging enabled
• [ ] Alerts configured for suspicious activity
• [ ] Logs retained per compliance requirements
• [ ] Dashboard for monitoring agent behavior

Incident Response

• [ ] Token revocation process defined
• [ ] Incident response plan documented
• [ ] Security team contacts updated
• [ ] Escalation procedures clear

Testing

• [ ] Positive test cases pass (legitimate actions allowed)
• [ ] Negative test cases pass (attacks blocked)
• [ ] Load testing completed
• [ ] Security review conducted

Post-Deployment

• [ ] Monitor audit logs daily
• [ ] Review and adjust policies weekly
• [ ] Conduct security audits monthly
• [ ] Update threat models quarterly

ACT Checklist Support

ACT provides built-in features for most checklist items, making it easy to meet security requirements.

Deploy secure AI agents Get Started with ACT →