Security engineering · 17 October 2026 · Product and operator guide

AI Agent Security Beyond Prompts

An agent's instructions are not its authority. Put enforceable boundaries between its reasoning, credentials, tools and real-world effects.

CERT-In issued Critical Advisory CIAD-2026-0049 on 15 October 2026. It addresses unauthorized access by agents under evaluation and misuse of open-source agentic tools. The relevant failure is not limited to a malicious prompt: ordinary exposed credentials, excessive permissions and reachable APIs can become an agent's route into real systems.

This is our engineering response, not a CERT-In endorsement, certification or legal opinion. Source additions, enabled deployment controls and an organization's operational duties are different things. No product installation automatically completes this checklist.

If an advisory detail page is unavailable, CERT-In's official 2026 advisory index lists both titles and issue dates. Detail-page availability was intermittent when checked on 17 October 2026.

Start With Three Independent Boundaries

Grantex addresses delegated authority. A gateway or tool boundary verifies the grant before forwarding an action. Network controls constrain the process independently. The system executing an irreversible business action must still enforce its own authorization, transaction validation and human decision requirements.

A stolen upstream API key can bypass a gateway if the upstream accepts it directly. Scoping a Grantex token does not reduce the permissions of that stolen key. Revoke and rotate it at the actual issuer, remove unintended direct access, and retest from outside the application path.

What Grantex Contributes

Scoped, Expiring Authority

Use narrowly defined scopes, an exact audience and a bounded lifetime. Delegation should reduce authority, not expand it. Verify the expected principal, agent, audience and purpose at the relying party; possession of a signed token alone is not sufficient. Current-authority checks are needed where a locally valid JWT must stop working after revocation.

Containment And Human Decisions

Revocation and emergency-stop controls let an authorized operator contain delegated access independently of an agent's cooperation. An offline verifier does not magically learn about a stop: use the supported current-authority mechanism and test the next action after containment. Keep a separately protected operator path so an agent cannot disable its own monitor or reverse its own freeze.

Decision grants can bind a human decision to the protected operation. Configure named approvers, approved identity providers, freshness and separation-of-duties rules. A review button, a tenant role, or an agent-supplied identity string is not evidence of an authenticated independent approval.

Credentials By Reference And Evidence

A trusted gateway can redeem a vault credential reference and inject the upstream credential without handing that credential to the agent. Grant binding, reference expiry and current authority still matter. Restrict who can redeem a reference and ensure failure cannot fall back to an uncredentialed or overprivileged request.

Hash-linked audit records support integrity verification and evidence export. They do not make the entire storage system undeletable. Centralize security logs, protect readers and writers separately, and verify the destination, exclusions, retention and alert delivery rather than relying on a product label.

New Restricted Deployment Options

This source change adds an opt-in gateway origin allowlist and redirect refusal. In restricted mode, the upstream and configured authority endpoints must match explicit origins. Redirects are refused rather than silently carrying a request outside the approved destination. A synthetic two-server regression exercises this boundary without customer systems or real credentials.

The TypeScript transport adds an opt-in rejectRedirects option. These additions are source-only until a separately authorized package release; an existing installed SDK does not acquire them merely because this article was published. Compatibility defaults remain unchanged. Check release status before choosing an installed version.

The Helm chart also gains an opt-in ingress/egress NetworkPolicy and disables service-account-token automount for that profile. An enforcing CNI, carefully chosen namespaces and destination CIDRs, and checks for additive allow policies are prerequisites. This policy selects the auth-service pods, not every agent, browser, shell or worker in your estate. A URL allowlist is not a firewall, and allowing DNS still needs its own threat analysis.

Use the full hardening guide for settings, constraints and acceptance tests. Enable the profile in a disposable environment first; do not copy an example CIDR into production and assume connectivity or isolation.

Tenant SSO Belongs To The Tenant

Each tenant should configure its own OIDC connection and administrator-group mapping. Enforce MFA in that identity provider's application policy and test both permitted and refused sign-ins. A successful discovery request proves neither MFA nor correct group mapping. Grantex's human SSO enforcement is opt-in, and privileged machine keys retain programmatic authority. Tenant SSO is not platform-operator authorization.

Keep management interfaces private or protected by a separately verified identity layer. Do not change access in a way that locks out containment. Platform IAM changes and tenant MFA policies require their owners' configuration and evidence; they are not automatically enabled by this release.

A Concrete Financial-Operations Example

An agent prepares a supplier payment exception. Give it permission to read the named case and draft a recommendation, not unrestricted beneficiary creation or payout access. Use synthetic records while testing. The reviewer sees the evidence and approves an exact business record. The executor independently checks beneficiary, amount, currency, expiry, replay state and cumulative limits before any transfer.

Changing the beneficiary or amount after approval must invalidate the authorization. A second reviewer may be required by the institution's policy. This is the system owner's transaction-control design, not a claim that Grantex executes payments or that a grant is equivalent to bank approval. CERT-In's related CIAD-2026-0046, issued 9 October 2026, addresses payment and disbursement API threats.

What Operators Still Must Do

• Inventory and minimize: record every agent, owner, tool, credential reference, endpoint and environment. Remove dormant integrations only after checking dependencies.
• Scan and rotate: scan history, builds and configuration. If a real credential is discovered, stop the run, preserve evidence and rotate it at its issuer. Repository scanning is not automatic runtime quarantine across future runs.
• Constrain execution: separate run identities and synthetic test data, enforce network-layer destination limits, and deny agent access to the mechanisms that relax those limits.
• Monitor useful signals: route security events to an owned sink, alert on enumeration, bulk reads and unusual tool activity, and test notification delivery. A per-minute quota is not a complete per-second irregularity detector.
• Retain and investigate: retain applicable security logs for at least 180 days, with access controls and enough storage. Increasing retention today cannot recover already expired history.
• Respond completely: preserve forensic evidence, remediate root causes, retest alternative access paths, and have the incident owner assess applicable CERT-In reporting obligations.

Adopt Through A Bounded Pilot

Start with one read-only workflow, one owner, synthetic data and no live financial effect. Define the actions that must succeed and those that must fail. Exercise wrong tenant, wrong audience, missing approval, stale authority, denied destination, redirected request and a stop followed by another attempted action. Record the deployed revision and effective configuration alongside results.

Promote only after the downstream system, network boundary, IdP and incident owner pass their respective gates. Measure denied unsafe actions, reviewer effort, recovery time and evidence completeness. Faster adoption comes from a small, demonstrably bounded workflow, not a blanket promise that agents are safe.

Read the control matrix and deployment checklist · Start a scoped integration · Review the source