# Zero Trust AI Agent Checklist

Use this before an AI agent can touch production data, code, cloud, SaaS, or ticketing systems.

## Identity

- Every agent has a unique identity separate from the human who starts it.
- Service accounts are named, owned, reviewed, and scoped to one workflow.
- Tokens are short-lived and bound to workload identity where possible.
- Human approvals use phishing-resistant authentication for sensitive actions.

## Authorization

- Read-only and write-capable workflows are separated.
- Production, secrets, customer data, source code, and deployments require explicit approval.
- Tool permissions are allowlisted and reviewed before use.
- Agents cannot silently expand from summarization into action.

## Runtime Controls

- Agents run in a sandbox or constrained execution environment.
- Egress is limited and logged.
- Tool calls, shell commands, browser actions, and file edits are recorded.
- Risky sessions can be revoked mid-run.

## Provenance

- Logs tie together prompt, model, tool call, command, artifact, reviewer, and deployment.
- Model gateway logs preserve provider, route, user, key, and token metadata.
- Incident responders can reconstruct what happened without guessing.

## Exercise

- Run a tabletop where an agent is prompt-injected.
- Run a tabletop where an agent token is stolen.
- Run a tabletop where an agent opens a dangerous pull request.
- Measure whether the team can detect, contain, revoke, and explain the event.