Three questions a security lead asks about your AI agent

When an enterprise security team evaluates your AI product, they don’t ask how accurate your model is. They ask about the system around it, and three questions come up every time.

1. “What can this agent do that a user cannot?”

If your agent has tool access (shell, file system, API calls), the answer is usually “more than you think.” The agent runs with the permissions of its process, not those of the user who prompted it. Most AI products don’t enforce least privilege at the tool layer.

The follow-ups come quickly. What happens if a user with read-only permissions asks the agent to delete something? Can the agent reach data that user shouldn’t see? Can it move sideways into systems the product never meant to touch?

2. “Where are the logs?”

Not model inference logs. Action logs: which tool was called, with what arguments, producing what result, triggered by what prompt.

If a customer’s data gets touched by an agent, the security lead needs the full chain from input to action. Most agent architectures log the model call but not the tool execution, so the chain breaks at the exact point it matters.

3. “Has anyone tried to break it?”

Not “have you run a scanner.” Security leads who have been through vendor risk reviews know the difference between an automated scan and an adversarial test. They want to know if someone sat down with the system and tried to make it do something unintended: prompt injection, tool misuse, data exfiltration through context.

For multi-tenant products, this question has a sharper edge. Does the agent’s memory persist across tenants? Is each session isolated? Can a prompt injection in one user’s context affect another user’s session?

These are not AI questions

They are the questions a security team asks about every piece of software that touches production data. The difference is that many AI teams haven’t prepared answers yet, and they hear the questions for the first time in the middle of a deal.

That is a bad place to learn what your product doesn’t do. If you can answer all three before the review starts, you close faster. If you can’t, the review becomes the reason the deal stalls.

If you’d rather find out before the customer asks, book a scoping call.