by PrivScan (LX AI)
Agents that can call tools and read secrets are no longer demos - they are production systems. This checklist is the pre-deployment gate we use at LX AI before any agent touches real data. It maps to the OWASP Top 10 for LLM Applications (2025) and the EU AI Act (Regulation (EU) 2024/1689).
List the system prompt, the tools the agent can call, and the data each tool touches. You cannot guard what you have not enumerated. (OWASP LLM06 - over-reliance; LLM01 - prompt injection surface.)
Treat any external content the agent reads - emails, web pages, tool output - as untrusted. Strip instructions, require structured tool outputs, and keep a deterministic allow-list for sensitive actions. (OWASP LLM01.)
Secrets belong in env vars, never in prompts or logs. Scan env files and CI config for leaked keys before deploy, and rotate on hit. (OWASP LLM02 - sensitive information disclosure.)
Deletes, sends, and payments should be gated. The EU AI Act puts human oversight (Art. 14) at the center of high-risk obligations. (EU AI Act Art. 14.)
Every agent run needs a stable runId and a ruleset version so a bad output is traceable to a specific input and policy. This is your audit trail. (EU AI Act Art. 11 - technical documentation.)
Cap token spend per run and per day. Unbounded agents turn a bug into a bill. Surface HTTP 429 when the guard trips instead of silently degrading. (OWASP LLM10 - unbounded consumption.)
Policy logic should be reviewable in a pull request, not buried in a prompt. Version each ruleset so regressions are diffable. (EU AI Act Art. 9 - risk management.)
Want a fast, self-serve read on your own agent? Try PrivScan