Give each agent its own identity, start read only, put approval on anything that deletes, sends or pays, expire write grants, log every call and review quarterly. Ten rules cover most of the risk for a small team without a dedicated platform group.
The ten rules
| Rule | In practice |
|---|---|
| 1. One identity per agent | No shared logins or personal tokens |
| 2. Name an owner | One person answers for each agent |
| 3. Read first | New agents start with read tools only |
| 4. Allowlist tools | Anything not listed is blocked |
| 5. Narrow tools over a shell | Use general tools only in a sandbox |
| 6. Limit arguments | Folders, recipients and amounts capped in code |
| 7. Approval for delete, send and pay | A person who is not the requester |
| 8. Expire write grants | Days or weeks, renewed by decision |
| 9. Log every call | Agent, tool, arguments summary, result, time |
| 10. Review each quarter | Remove unused grants and record it |
Where each rule comes from
Several map straight to published guidance. OWASP advises minimizing extensions and their functionality, avoiding open ended ones, limiting permissions, acting in the user's context and requiring approval for high impact actions. The MCP specification says servers must validate inputs, implement access controls and rate limit, and that clients should confirm sensitive operations and log usage.
Week one setup
- List the agents you already run, including those a teammate set up on their own.
- Write the owner next to each. No owner means switch it off until someone claims it.
- Move each to its own credential, and revoke shared ones.
- Write the allowlist as a file in a repository, and require a reviewer for changes.
- Turn on logging and check one real entry.
- Put a recurring review on the calendar before you forget.
What to skip at first
Skip elaborate scoring models, fine grained dashboards and a long approval chain. A short list that people follow beats a long one nobody reads. Add tiers by reversibility once the basics hold.
Signs it is working
Approvals get read, not clicked through. Removals happen at reviews. A new tool request arrives through the pull request and not through a chat message. When those hold, grow the process.
Safeguard offers MCP Guardrail and agent identity for applying this kind of policy to agent tool calls, and you can run a free scan of your own repositories at gold.safeguard.sh/scan. Autonomous fix pull requests are off by default, and every category starts on Manual.
Try it yourself
Click through it at your own pace, or open it full screen. Notice which questions the assistant can answer and what it needs to be connected.
Quick check
What if we have no security staff?
Name an owner per agent, keep tools read only to start and put approval on delete, send and pay. That covers the largest risks.
Which rule matters most?
Own identity per agent. Without it, scopes, logs and reviews cannot be attributed.
Sources
Last reviewed: 19 October 2026.
