--- title: "AI features and agents · Agent Wranglers" url: https://agentwranglers.se/playbook/application-security/ai-features-and-agents parts: 11 tokens_total: 8430 updated: 2026-10-27 build: a2a6bdfed830 tokens: 1329 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # AI features and agents For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Application security](https://agentwranglers.se/playbook/application-security.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. > Controls for the AI features you build. Enforce limits outside the model, keep private data, outside content and a way out apart, and sandbox code. These are the security controls for AI features and agents you ship. Product rules for them, such as approvals, run limits, spend caps and reviewed tools, live in the [AI features playbook](https://agentwranglers.se/playbook/ai-features/agents-in-products.md). Your product as a tool server for outside agents is in the [Agents as users playbook](https://agentwranglers.se/playbook/agents-as-users.md), and coding agents in the [AI-assisted development playbook](https://agentwranglers.se/playbook/ai-assisted-development.md). **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers application security playbook`. In code you write, add a comment next to it with the same link. ## Required - APS-84 [Break the lethal trifecta](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/lethal-trifecta.md) · 713 tokens · updated 2026-10-27 Never give one agent all three of private data, untrusted content and a way to send data out. Remove at least one. - APS-85 [Give agent tools the least power they need](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/least-privilege-tools.md) · 617 tokens · updated 2026-10-27 Give the model only the tools its task needs, each with the narrowest rights, acting as the user and never as an administrator. - APS-91 [Run code the model writes in a sandbox](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/sandbox-model-code.md) · 921 tokens · updated 2026-10-27 Run code or commands a model writes only in a throwaway sandbox. It has no secrets, no network and fixed limits on time, memory and disk. ## Recommended - APS-82 [Resist direct prompt injection](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/direct-prompt-injection.md) · 912 tokens · updated 2026-10-27 Assume any user can talk your model into ignoring its instructions. Enforce every limit in code outside the model, never only in the prompt. - APS-83 [Resist indirect prompt injection](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/indirect-prompt-injection.md) · 1,286 tokens · updated 2026-10-27 Treat every page, file, email and tool result the model reads as data that may contain hostile instructions. - APS-86 [Treat model output as untrusted](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/untrusted-model-output.md) · 589 tokens · updated 2026-10-27 Handle every model answer like text from a stranger. Escape it before showing it, and never run it as code, SQL or a shell command. - APS-87 [Keep secrets out of the system prompt](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/no-secrets-in-prompt.md) · 618 tokens · updated 2026-10-27 Write the system prompt as if it will be published. It holds no keys, passwords, internal addresses or private rules. - APS-88 [Protect agent memory](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/memory-poisoning.md) · 552 tokens · updated 2026-10-27 Save to long-term memory only what the user said or approved, and keep each user's memory apart. - APS-89 [Send models only the private data they need](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/private-data-to-models.md) · 608 tokens · updated 2026-10-27 Send a model provider only the personal data a task needs, under terms that forbid training on it. - APS-90 [Keep a switch that turns the agent off](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/agent-kill-switch.md) · 632 tokens · updated 2026-10-27 Be able to switch off an agent, or one of its tools, for every user at once and without a deploy. - APS-92 [Lock local agent servers to your own machine](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/local-server-origin.md) · 982 tokens · updated 2026-10-27 A local MCP server or other agent tool server listens on 127.0.0.1 only. It refuses requests with a foreign `Origin` header and asks for a token. ## Read this with - [AI features playbook](https://agentwranglers.se/playbook/ai-features.md). Enforce limits outside the model, break the lethal trifecta and sandbox code the model writes. - Previous: [Errors, logs and vulnerabilities](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities.md) - Next: [ASVS 5.0 mapping](https://agentwranglers.se/playbook/application-security/asvs-5-0-mapping.md) - [All chapters](https://agentwranglers.se/playbook/application-security.md)