01 / Map the workflow
What is an AI agent harness?
Identify where instructions, tools, credentials and memory meet. The model is only one part of the system you need to secure.
Oktsec Research / Practical guides
AI agent security guides.
Secure the tools, credentials and systems an agent can use. These guides help your team review a workflow, set limits on its actions and check whether those limits hold.
Looking for the March 2026 guide or executive brief? This reading path replaces those editions with current articles, sources and practical checks. Updated October 6, 2026.
Start with one consequential workflow.
Choose a task such as preparing a release, reviewing a payment issue or answering a support request. List the data it needs, the actions it may take and the person responsible for approving exceptions.
In an isolated test environment, confirm that the allowed task succeeds and an out-of-scope action is rejected. Check the tool path, the credentials behind it and any direct API or shell access. Keep the outcome and any gaps in coverage alongside the test.
Map a workflow with the free checklist →Read by the control you need.
02 / Review skills and tools
AI agent skill security: the OWASP Top 10 explained
Examine bundled scripts, external instructions, permissions and updates. Use the eight checks to test an approval process.
03 / Restrict access
How to secure an MCP server
Authenticate callers, scope tool permissions and check destination access. Test alternate routes as well as the configured gateway.
04 / Keep controls current
Cyber hygiene for AI agents
Maintain an inventory, investigate changes, update dependencies and verify fixes. Start with the systems your agents can actually reach.
05 / Test the development workflow
AI coding agents need more than secure code
Follow a billing API change through code review, tool permissions and dependency checks. Record what was tested and what remains outside scope.
06 / Preserve useful evidence
Agent work needs evidence, not trust
Record the identity, policy, action and outcome. A signed record helps verify integrity; it does not establish that every action was observed.
Bring the checks to your environment.
Oktsec Assessment scopes tests of applications and agent workflows. Control applies policy on configured action paths. Signal supports inspection of skills and dependencies. Each page explains its scope and current capabilities.