We run multiple AI agents in production, side by side, every day. They draft, research, check each other's work and hand tasks off. That experience changed how we think about securing agentic systems, because the risks show up in the gaps between agents more than inside any single model.
This post shares the general lessons. It does not describe any client environment or internal configuration.
1. Treat every agent as a separate identity
An agent that can read email, browse the web and call tools is a privileged account. We give each agent its own scoped credentials and its own set of tools, sized to its job. When one agent is compromised or confused, the blast radius is the permissions of that one agent, not the whole system.
2. Assume anything an agent reads can carry instructions
Web pages, documents, tickets, emails and tool results can all contain text that looks like a command. We label external content as data, not instructions, and we never let content an agent read decide on its own what that agent does next. This is prompt injection, the top entry on the OWASP Top 10 for LLM Applications, and in multi-agent systems it can travel from one agent to the next through handoffs.
3. Put a human approval step in front of irreversible actions
Sending a message, publishing content, spending money, deleting data and changing access are actions you cannot take back. We require explicit human approval for each of them, scoped to the specific action, and we treat a declined approval as final. Agents draft; people decide.
4. Keep handoffs explicit and small
When one agent hands work to another, we pass a short, structured brief instead of a full transcript. Smaller handoffs leak less context, are easier to review, and make it obvious when an agent has been asked to do something outside its role.
5. Log what agents do, not only what they say
Every tool call, its inputs and its result go to a log we can review. When something looks wrong, we can reconstruct which agent did what and why. Without that record, incident response for agentic systems turns into guesswork.
6. Verify before you trust a claim
Agents can state things confidently that are not true. We check facts against primary sources before anything is published or acted on, and we record what was verified and when.
7. Save state before you change anything
Before an agent edits a system, it saves the current value so the change can be rolled back. Reversible by default is one of the cheapest safety controls available.
Where to start
If you are moving from one AI assistant to several cooperating agents, start with identities and approvals. They prevent the most damage for the least effort. If you want a second set of eyes on an agentic design, reach out through our contact form or at info@menagos.com.