AI agent security best practices come down to one principle: an agent should only be able to do what its job needs, every action should be recorded, and anything risky should either wait for a person or be impossible. This guide lists nine controls that make that real, and shows how AlianHub enforces each one in the product rather than in a policy document.
Key takeaways
- The safest action is one that does not exist. Remove dangerous actions, do not just disable them.
- Agents should never see more than the person who owns or uses them.
- Wider changes wait for approval. Single-task changes come with Undo.
- Log everything, including refusals.
- Offboarding an AI should take one click.
Why AI agents need their own security model
A normal user account is used by one careful human. An agent can act quickly, repeatedly and on a schedule. A prompt in a task description, a misread instruction or a stolen token can turn a helpful agent into a fast-moving problem.
So agents need controls that people do not: hard limits, budgets and a clear record.
Assume an agent will one day be wrong. Design so that being wrong is cheap.
The 9 controls
| # | Control | How AlianHub does it |
|---|---|---|
| 1 | Least privilege | Allowed actions per agent; connected AI works as you |
| 2 | Hard stops | Destructive actions do not exist for agents |
| 3 | Graduated autonomy | L0 to L3, project can be stricter |
| 4 | Human approval | AI Inbox for wider changes |
| 5 | Risky-write routing | Outside apps' risky writes wait for a person |
| 6 | Full audit | Every action, proposal and refusal logged |
| 7 | Reversibility | Undo, with a time window |
| 8 | Budgets and rate limits | Spend caps, daily action limits, pause all |
| 9 | Clean offboarding | Revoke a token or app in one click |
1. Least privilege
Each AlianHub agent has a list of allowed actions. Nothing outside that list can run. Agents get a role's permissions minus anything destructive.
When a person connects Claude or ChatGPT, it works as them and sees only what they can open. Tokens for Claude Code are scoped to chosen projects.
2. Hard stops
Deleting a project or task, billing, deploying to production, merging code, removing a member, changing permissions and marking a task Done do not exist as agent actions. Even a stolen token cannot reach them, and attempts are logged.
3. Graduated autonomy
Agents run at L0, L1, L2 or L3. Only L2 and L3 act on their own, and only on low-risk, reversible changes. A project can hold every agent to proposals only. See AI agent autonomy levels.
4. Human approval
Wider changes, like moving tasks between lists or assigning work, wait in the AI Inbox. Whoever approves must be able to open the same task and hold the same permission. When you decline, the AI is told and does not try another way.
5. Risky-write routing
With AGENT_TAINT_ROUTING on, which is the default while the AI tools are on, a change by an app connected by address that reaches past one task waits for approval, or is refused if the app lacks the matching permission.
6. Full audit
The audit log records agent actions, outside agents, gated actions, undone changes and refusals. You can search it and export to CSV.
7. Reversibility
Changes that can be undone show Undo and "Undo until (time)", 24 hours by default. After approving a waiting change, the AI Inbox shows Undo for 15 minutes. Nothing is deleted for good.
8. Budgets and rate limits
Each agent has a daily action limit and a monthly spend cap. There are rate limits per agent and a one-click pause.
9. Clean offboarding
Revoke a personal token and it stops on its next call. An admin can revoke an app for the whole workspace.
Tip: memory imports are a quiet risk in many AI tools. In AlianHub, when you bring memories from ChatGPT, Gemini or Claude, passwords, keys and card numbers are removed first.
How to do this in AlianHub
- As an owner or admin, open Settings, Agent clients. Approve only the apps you want, and under "Allow at most:" choose their permissions. Leave the wider manage and chat permissions unticked unless needed.
- Open AI in the left menu, then the Agents tab. For each agent, check its allowed actions, set its level and set a spend cap.
- For sensitive projects, set the project to "Propose everything".
- Ask each person to review their tokens under AI › Accounts › My account and set expiry dates if your admin requires them.
- Each week, open AI › Audit log and filter by "Refusals" and "Gated actions".
- Show every owner where Pause all agents is: on the project's detail screen under "Agents working at the same time", and the workspace-wide switch on the AI controls screens.
- When someone leaves, revoke their connected apps under Accounts, Connected apps and their tokens.
A business scenario
A clinic administration team wants AI to sort appointment and supplier tasks but handles sensitive information. It runs a self-hosted model so nothing leaves its network, sets every project to proposal-only, and approves only one outside app.
The result: staff save time on routine sorting, the practice manager approves changes in the AI Inbox, and when an auditor asks "what did the AI do last month?", the answer is a CSV export from the audit log. Security becomes a reason to adopt AI, not a reason to block it.
Common mistakes to avoid
- Giving agents admin roles "to be safe". In AlianHub agents never get destructive permissions, but in any tool, broad roles are the main risk.
- Skipping expiry dates on tokens. Old tokens are forgotten tokens.
- Nobody owning the AI Inbox. Unreviewed proposals pile up and people start approving in bulk.
- No budget. Even a correct agent can be expensive in a loop.
A control nobody checks is not a control.
For the full model, read the AI controls page and the admin guide.
FAQ
What are the most important AI agent security best practices?
Least privilege, hard stops on destructive actions, human approval for wider changes, full audit logs, undo, budgets and quick offboarding. AlianHub builds all of these into the product.
Can a stolen token delete my projects in AlianHub?
No. Deleting projects and tasks does not exist as an action for agents or connected AI, so a stolen token cannot reach it.
How do I see what an AI agent did?
Open AI, then Audit log. You can filter by agents, outside agents, gated actions, undone changes and refusals, and export to CSV.
Can I stop all AI at once?
Yes. One switch pauses every connected agent across the workspace, and owners can pause all agents in a single project.
Check these controls yourself on the live demo, and share this checklist with whoever signs off on AI at your company.