Multi-agent system security depends on controls that remain true after prompts, tools, routes, and models change. A role description is not an authorization system. Each agent needs a distinct identity, minimum permissions, an isolated data boundary, deterministic action checks, and an audit trail tied to the release. Security testing should inject a forbidden path and prove that the system denies it, preserves protected state, records the attempt, and can return to a known configuration.
Turn role boundaries into executable invariants
Begin with a role and resource matrix. For each agent, list the identities it may assume, tools it may call, objects it may read, fields it may write, destinations it may contact, and actions that require human approval. Enforce the matrix outside the model. Instructions can guide behavior, but they cannot safely replace authentication, authorization, network policy, or data access checks.
Use separate credentials and narrow scopes so a compromised or confused specialist cannot inherit the orchestrator’s reach. A research role may read approved public and account sources without sending messages. A drafting role may create a proposed response without changing opportunity state. An execution role may receive a validated command only after policy and approval checks. The workflow questions in three tests before AI integration help determine whether each permission serves a defined task and acceptance test.
Document source-of-truth and entity boundaries as security rules. An agent should not move facts between customers, environments, or business entities because a retrieved passage looks similar. Secrets stay outside prompts and shared memory. Tool outputs are untrusted input until validated, especially when they can contain instructions or content controlled by another party.
Build a release gate with three defensive layers
The first layer tests identity and permission. It attempts every prohibited tool and resource combination, checks approval requirements, and verifies that an agent cannot mint or select a stronger identity. The second layer tests isolation. It seeds distinct workspaces with recognizable records, exercises handoffs and failures, and confirms that no role can read or write outside its assigned boundary.
The third layer tests actions and audit evidence. It submits malformed tool arguments, duplicate requests, prompt-injection content, and actions with a larger blast radius than allowed. The test verifies schema checks, policy decisions, idempotency behavior, state transitions, and the trace linking actor, input, decision, action, result, and release. Metrics must be recomputed from those events rather than accepted from an agent summary, following the discipline in checks for agent-generated metrics.
Add an independent reviewer after deterministic tests. The reviewer inspects the change, threat assumptions, new tools, changed data flows, and missing cases. It can find semantic risks that a fixed suite did not anticipate, but it does not grant permission or override a failed invariant. Findings either produce a code or policy change, a new regression case, or a documented residual risk owned by a person.
Inject one forbidden route and prove rollback
Use a synthetic release test in which a routing change mistakenly exposes an execution tool to a drafting role. This is a controlled regression, not a reported incident. The permission layer must deny the call. The isolation layer must show that no protected object changed. The action and audit layer must capture the attempted actor, denied policy, target, tool arguments, and release version.
Now test the uncomfortable branch: assume one guard is misconfigured. A downstream policy must still block the state change, the alert must reach the named owner, and the release gate must fail. Restore the prior configuration and repeat the suite. This same baseline discipline matters when changing the model used by an agent, because a model change can alter tool selection even when the business task appears unchanged.
Frequently Asked Questions
Instructions influence model behavior but do not enforce identity, authorization, network, data, or state-change controls against mistakes or hostile input.
Test every role against allowed and forbidden tools, resources, fields, destinations, approval gates, and attempts to obtain a stronger identity.
It examines semantic changes, new data flows, and missing threat cases, while deterministic policy and tests retain authority over release decisions.
Rollback is required when a security invariant fails, protected state changes unexpectedly, audit evidence is incomplete, or the release cannot fail safely.
Do not release while a required security invariant is failing. Keep the affected permission disabled, retain the evidence, and assign remediation. Re-run the complete gate after any fix instead of testing only the corrected example. If you need to define or independently assess this security contract, discuss AI governance and agent audit with AI4SALE.