Boundaries before autonomy
AI agent security built around tool boundaries
Treat every tool call as a privileged operation. Scope access per agent, forward the user’s identity to your backend, and require confirmation before consequential actions.
- AI agent security
- AI agent security risks
- secure AI agents
- agent tool security
Threats, mapped to controls
AI agent security risks — and the boundary for each
An agent is a program that writes its own next step, so every risk needs a boundary the model cannot talk its way past. Each of these controls is built into the runtime — not a gateway you bolt on later.
| Risk | Built-in control |
|---|---|
| Prompt injection via tool output | Unknown and MCP tool output is risk-classified and wrapped before it reaches the model, so a poisoned document or API response cannot quietly rewrite the agent’s instructions. |
| Over-permissioned agents | Per-agent tool scoping: each specialist gets only its designated tools and MCP servers. A rules agent never silently gains billing tools. |
| Unauthorized data access | The end-user’s identity — Authorization, organization, user, and custom headers — is forwarded into every MCP and HTTP tool call, so your existing RBAC enforces itself on every request. |
| Rogue writes | confirm_before gates pause execution on consequential tools until the user explicitly approves — the agent proposes, a human disposes. |
| Token theft or forgery | Ed25519-only JWTs (algorithm-confusion attempts are rejected, expiry is required) plus scoped API tokens that are SHA-256-hashed at rest. |
| Admin surface exposure | Optional two-port split: the data plane serves chat while the entire admin plane sits on a separate port behind your VPN or firewall. |
Enforced by the runtime, not the prompt
Secure AI agents with runtime-enforced boundaries
Prompts are suggestions; configuration is law. The three boundaries that matter most are all enforced below the model:
- Tamper-proof authentication. Ed25519 (EdDSA) is the only JWT algorithm the engine accepts — algorithm-confusion attacks are rejected outright, and every token must carry an expiry.
- Per-agent tool scoping. Each agent sees only the tools it was assigned. Delegation between specialists does not merge their permissions.
- Confirmation before consequence. Tools marked
confirm_beforestop the run and stream a confirmation event; execution resumes only on explicit approval. - Forwarded identity. Your backend receives the real end-user’s Authorization, org, user, and custom tenant headers on every tool call — SyntheticBrew never becomes a super-user in your system.
Contrast this with wiring agents through a general-purpose automation tool, where one shared credential often acts for every user — a difference we walk through in SyntheticBrew vs n8n.
Credentials
Agent tool security: scoped tokens and Ed25519-only JWTs
Every credential in the system is designed to fail small.
- Scoped API tokens. A scope bitmask per token — chat, tasks, agents read/write, models, MCP, config, audit, admin — means a token for the chat API physically cannot touch configuration.
- Hashed at rest. Tokens (
bb_+ 64 hex characters) are shown once and stored only as a SHA-256 hash; a database leak does not leak usable credentials. - BYOK, never retained. Per-request LLM keys are used and discarded — never stored, never logged.
- Embed safely. The chat widget enforces per-tenant
frame-ancestorsCSP, so your widget only loads on the origins you approved.
# API token — bb_ prefix + 64 hex chars, # shown once, SHA-256-hashed at rest bb_4f6c…64-hex…a91e # Scopes are a bitmask on the token: # chat · tasks · agents read/write · models # mcp · config · audit · admin … # JWT verification alg: EdDSA (Ed25519) # the ONLY accepted algorithm exp: required # unexpiring tokens rejected
Network boundary
AI agent security at the network layer: two-port deployment
Self-hosted deployments can split the engine into two planes on separate ports. The external data plane (for example, port 8443) serves only the chat and agent APIs your product needs. The internal admin plane (for example, port 8444) carries the dashboard and every management API — and lives behind your VPN or firewall, unreachable from the internet even if the data plane is public.
The result: the surface an attacker can reach cannot reconfigure anything, and the surface that can reconfigure things is not reachable. Combined with audit trails from agent observability, this is the deployment shape that banking workflows and other enterprise environments expect.
Questions
AI agent security: common questions
How are API tokens stored?
Tokens use the format bb_ followed by 64 hex characters, are shown once at creation, and only their SHA-256 hash is stored at rest. Each token carries a scope bitmask — chat, tasks, agents read/write, models, MCP, config, audit, admin, and more — so a leaked narrow token cannot reach the admin surface.
What does the audit log record?
Every consequential operation with actor type and subject, action, resource, a structured details JSON payload, session id, and task id. A separate tool-call log is queryable by session, tool, agent, status, user, and time.
How are bring-your-own LLM keys handled?
BYOK per-request keys are used for the request and discarded — never stored and never logged. In self-hosted deployments your provider keys live in your own configuration, inside your own perimeter.
Can a clever prompt give an agent extra tools?
No. Tool scopes are enforced by the runtime, not by the prompt: an agent can only call tools that were explicitly assigned to it in configuration. No instruction — from a user, a document, or another agent — can expand that set at runtime.
Keep exploring
AI agent security pairs with these capabilities
Give agents autonomy inside real boundaries
Scoped tools, signed identity, confirmation gates, and an admin plane behind your VPN — start in Cloud or self-host inside your own perimeter.