Agentic FabriqResource · Published by Agentic Fabriq
AI Agent Security Evaluation Checklist: 12 Controls to Test
Evaluate an agent security product by testing what it can identify, restrict and record in your environment. For each control below, request evidence, run a scoped test in an approved test environment, and document the boundary of the result. This checklist is published by Agentic Fabriq.
About this checklist
This is an evaluation method written and published by Agentic Fabriq, a vendor in this category. It is not an independent review, a third-party certification or a ranking of products. The table records no scores and no verdicts: every column is something you ask for or run yourself, and the results are yours. Run the same twelve tests against every product you consider, including ours.
The 12 controls
Run each test only in an environment you are authorised to test, on resources you can afford to lose.
| Control | Question | Evidence to request | Test in an approved test environment | Pass condition | Limit to document |
|---|---|---|---|---|---|
| Control 1IdentityIdentity | QuestionCan you distinguish individual agents? | Evidence to requestAgent identity and authentication documentation | Test in an approved test environmentRun two agents against the same connected tool | Pass conditionRecords identify the correct agent for each request | Limit to documentShared credentials or unsupported entry points |
| Control 2OwnershipOwnership | QuestionWho owns each registered agent? | Evidence to requestOwner field and lifecycle procedure | Test in an approved test environmentRegister an agent and inspect its owner and purpose | Pass conditionResponsible owner and intended purpose are retrievable | Limit to documentUnregistered agents may have no known owner |
| Control 3User delegationUser delegation | QuestionWhose authority does the agent use? | Evidence to requestDelegation model and request identity fields | Test in an approved test environmentRun the same agent for two test users | Pass conditionEach request is tied to the correct acting user | Limit to documentProvider token types may differ |
| Control 4Permission intersectionPermission intersection | QuestionCan an agent exceed either grant? | Evidence to requestAgent/user permission evaluation rules | Test in an approved test environmentGrant the user a permission the agent lacks, then reverse the case | Pass conditionRequests outside the required intersection are refused | Limit to documentVerify resource-level versus scope-level granularity |
| Control 5Credential isolationCredential isolation | QuestionCan provider secrets reach agent context? | Evidence to requestCredential storage and injection architecture | Test in an approved test environmentInspect documented client payloads and controlled traces | Pass conditionProvider credentials are absent from agent-facing payloads | Limit to documentServer/operator access remains a separate boundary |
| Control 6Policy enforcementPolicy enforcement | QuestionIs authorization checked before execution? | Evidence to requestEnforcement point and decision record | Test in an approved test environmentAttempt a disallowed operation on a disposable resource | Pass conditionNo external action occurs and a refusal is recorded | Limit to documentCalls bypassing the enforcement point need separate controls |
| Control 7RevocationRevocation | QuestionWhat changes when access is revoked? | Evidence to requestRevocation semantics, cache behavior and token lifetime | Test in an approved test environmentRevoke a test grant and retry under the documented timing | Pass conditionThe request fails within the stated bound | Limit to documentAlready-running calls and provider sessions |
| Control 8Audit completenessAudit completeness | QuestionAre allowed and refused attempts recorded? | Evidence to requestExported event schema and example records | Test in an approved test environmentRun one allowed and one denied operation | Pass conditionBoth records contain the documented identities, action and verdict | Limit to documentTool-call logs do not automatically include model reasoning |
| Control 9ExportExport | QuestionCan records be used outside the product? | Evidence to requestSupported export format, fields and retention | Test in an approved test environmentExport the test events and check them in the destination format | Pass conditionRequired fields and timestamps survive export | Limit to documentPlan limits, retention and downstream configuration |
| Control 10Discovery coverageDiscovery coverage | QuestionWhat activity can be discovered? | Evidence to requestInputs, coverage model and verdict definitions | Test in an approved test environmentCompare known traffic inside and outside the governed path | Pass conditionKnown test traffic is classified according to the documented rules | Limit to documentUnobserved networks and incomplete logs |
| Control 11Bypass pathsBypass paths | QuestionCan an agent reach a tool outside the controls? | Evidence to requestRouting and credential migration requirements | Test in an approved test environmentReview approved alternate credentials and network paths | Pass conditionEach relevant path is controlled or explicitly documented as uncovered | Limit to documentMoving one credential does not close every path |
| Control 12DeploymentDeployment | QuestionWhat setup is required for the claimed protection? | Evidence to requestDeployment architecture and responsibility split | Test in an approved test environmentTrace one end-to-end test request in the proposed deployment | Pass conditionRequired components and customer responsibilities are demonstrated | Limit to documentCoverage depends on the deployed configuration |
Use the results to separate demonstrated controls from assumptions. Review your agent access architecture with Fabriq Enterprise.
Where these controls are described
- AI agent security — the controls a security team is asked to review.
- Agent permissions — how agent and user grants are evaluated per call.
- Audit trail — what a governed tool call records and exports.
- Shadow AI — discovery coverage and the paths outside the governed one.