First AI agents with tool access secured: least-privilege tools, human approval and prompt-injection testing
A mid-size company of about 400 employees, a leader in its segment.
- Scale
- 3 agents, 14 tools, 2 approval tiers, 120 adversarial test cases, 1 gateway with full logging
- Engagement
- 10 weeks from design to a controlled pilot
The challenge
Three teams were building AI agents that could read email, query the CRM and ticketing system and draft changes. Each used a shared service account and broad API keys, and nobody had tested what happened when an agent read a document that contained hidden instructions. Security wanted the pilot to continue, but not with an agent able to send data outside the company or change records on its own.
What our team delivered
- Inventory of every agent, tool and data source, with an owner for each and an agent identity of its own instead of a shared account
- Least-privilege tools: 14 tools cut down to narrow, scoped actions, read-only by default, with short-lived credentials and no direct database access
- A gateway between agents and tools that enforces an allow list, rate limits and egress rules, and logs every call with the user, the agent and the arguments
- Two approval tiers: reads and drafts run on their own, while sending external mail, changing records and moving money need a named person to approve in the tool
- Prompt-injection testing with 120 adversarial cases in documents, web pages, email and tool output, run again after every prompt or tool change
- A review of each connected MCP server and a runbook to disable an agent in minutes, with alerts on unusual tool use
Result
The pilot went live with agents that cannot act outside their scope, and every action is attributable to an agent and a person. In the first test run, 23 of 120 injection cases changed agent behavior; after the fixes, none caused an unapproved action. The security team now has a repeatable gate before any new tool is connected. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
AI agent bot, standard
One bot for a task that crosses two systems or handles varied documents, with exception handling and a review queue for your team.
About 3 to 4 weeks
$5,900 per bot
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Show 2 more
Microsoft Copilot and AI readiness
Before you turn Copilot on, find out what it will be able to see, and fix the permissions first.
Report within 8 business days
$2,400 per tenant
Clayton Secure program
One monthly program that bundles monitoring, patching, backups, email protection and security awareness for your whole team. Priced per team member.
Onboarding starts within 10 business days
$150 per team member, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Every agent tool call passes one checkpoint
Agents reach MCP servers only through a gateway that checks policy, enforces a per-agent scope allow-list and logs every call to the SIEM. A call outside the allow-list is blocked. A local stdio server started on a laptop skips the gateway, so it needs its own control.
Three approval tiers for AI agents
Every action an agent can take falls into one of three tiers: it runs on its own, a named person approves it first, or a human always does it. The examples are illustrative; each firm draws its own lines during scoping.
An agent with its own identity and its own token
A named human sponsors each agent. The agent gets its own identity from a blueprint, signs in and receives a token bound to one audience with narrow scopes. The resource server validates the audience, so a token meant for one resource is rejected anywhere else. No passthrough.
How we audit an MCP deployment
We inventory every server, read its configuration and manifest, scan statically, test authorization against the MCP specification, red-team with adversarial prompts, map each finding to OWASP agentic categories, and retest after the fix.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.