Securing AI Agents — Part 1: Identity, Permissions, Sandboxes & Human Gates — 42 Templates & Checklists for Agent Identity & Inventory, Least-Privilege Permissions, Sandbox Containment & Human Approval Gates

An agent is delegated authority packaged as software — and Part 1 of its security is naming it, bounding it, containing it, and gating what cannot be engineered down. 42 production templates & checklists distilled from Chapters 1–5 of Securing AI Agents (plus its Appendix C Permission Matrix and Tool-Risk Rubric): the eight-field agent registry, workload identity and per-session scoped credentials, the permission matrix and tool-risk rubric, sandbox layers, egress control and resource limits, and human approval gates that scale without becoming theater. PDF + Markdown source.

Nobody got in. No credential was stolen. The agent just did its job.

At 02:14 on a Tuesday, Harborline Logistics' finance reconciliation agent — the book's fictional worked example — began issuing refunds. It had authenticated correctly every time, stayed inside its permission set, followed its instructions literally, and logged every action it took. By the time a human glanced at a total, it had paid out an illustrative $86,000 in duplicate and unwarranted refunds. The design was the vulnerability. Securing AI Agents — Part 1 is the working discipline for the foundation half of agent security: 42 copy-paste templates and checklists distilled from Chapters 1–5 of the dedicated agent-security book — test whether a system is an agent at all, compute its blast radius, give every agent a real identity in an enforced registry, mint its credentials per session and per task, write every permission as a sentence on one matrix, score every tool action before you connect it, contain execution in a sandbox built like a seatbelt, and put a human gate — a real one, with a screen an approver can actually judge — on the actions whose blast radius cannot be engineered down.

Every template carries the book's tested positions built in: a four-part agent test (acts, persists, chains, spends authority), an eight-field registry that credential issuance actually enforces, workload identity attested by the platform and never held by the model, a permission matrix whose worked rows cap a support agent's refunds at $50 with anything larger prepared for a human, a tool-risk rubric scored on reversibility, blast radius, data sensitivity, and financial effect, scoped session tokens that refused a $310 injected refund on two independent grounds, five sandbox layers compared honestly on escape risk, an egress policy that hard-blocks the cloud metadata endpoint, resource limits filed under security rather than cost, and approval gates scored on irreversibility, value, and novelty — the book's programme cut its gate volume from about 400 requests a day to about 180, because a gate that approves in three seconds is worse than no gate. Where the book gives an example — its caps, its worked matrix rows, its illustrative limit settings — the template labels it as the book's example for you to tune. Bracketed fields are yours to fill; nothing here invents a threshold for your system. The book's worked estate, Harborline Logistics and its agents Ledger, Dockside, and RouteSmith, is a fictional composite, labeled fictional in the book itself.

What's inside — 42 templates & checklists in 7 sections

1. The Agent Is Not a Chatbot — Delegated Authority & Blast Radius (6) — Four-Part Agent Test & Estate Inventory · Five-Part Agent Anatomy Diagram Worksheet · Delegated-Authority Inventory · Inherited-Controls Failure Audit · Blast-Radius Estimation Worksheet · Confused-Insider Incident Review Worksheet

2. Name It to Govern It — Registry, Workload Identity & Credentials (6) — Agent Registry Template · Registry Enforcement & Drift-Check Sheet · Workload Identity Specification · Credential Issuance Flow & Registry Record Template · Standing-Secret Hunt & Elimination Checklist · Shared-Key Migration Plan

3. Lifecycle, Ownership & the Shadow Agents You Already Have (4) — Credential Break-Glass Exception Register · Agent Lifecycle Transitions & Suspension Drill Sheet · Ownership & Quarterly Re-Attestation Sheet · Shadow-Agent Discovery & Amnesty Plan

4. Permissions Are the Product — Matrix, Rubric, Tokens & the Quarterly Diff (9) — Permission Sentence Worksheet — verbs, resources, conditions, deny by default · Grant Decision Outcomes Sheet · Permission Matrix Template · Matrix Policy-File Companion Template · Tool-Risk Rubric Scoring Sheet · Appendix C Template Pair — the Permission Matrix & Tool-Risk Rubric as the book's library prints them · Scoped Session Token Design Sheet · Just-in-Time Elevation Procedure · Quarterly Permission Diff & Creep Review

5. The Sandbox Is the Seatbelt — Containing Code, Files & Networks (6) — Execution-Type Inventory & Containment Match · Sandbox Layer Selection Sheet · Filesystem Isolation Checklist · Egress Control Policy Template · Resource Limits Configuration Sheet · Sandbox Escape Drill & Canary Plan

6. The Human Gate — Approvals That Scale Without Becoming Theater (8) — Gate-Worthiness Scoring Sheet · Pre-Authorized Containment Sheet · Approval Request Screen Template · Approval-Gate Checklist — the book's Chapter 5 gate standard (14 checks) · Gate Tier & Timeout Routing Table · Approval Ladder & Decision-Envelope Sheet · Fatigue Countermeasures & Attention Metrics Sheet · Break-Glass, Delegation & Gate Audit-Trail Sheet

7. Part 1 Gates & Working Artefacts (3) — Control Map Coverage Sheet · Gate-Health Spot-Check Sheet · Part 1 Agent-Security Gate — Chapters 1–5 Sign-Off — the book's five chapter checklists consolidated into one evidence-backed gate (25 lines)

Who this is for

Security architects and platform leads who own agent systems in production, CISOs asked to govern a fleet they did not build, and agent builders whose demos have started holding real credentials. The source book assumes you know how your organisation's systems are generally built — services, APIs, data stores, vendors — and that you have at least one agent, or one agent-shaped plan, past the demo stage. If nobody in your organisation can answer which agent made a given finance call — in one sitting — start at Template 7.

What this pack is not

Not Part 2. Injection at the tool boundary, the audit record and log schema, memory poisoning and write gates, delegation chains and the confused deputy, blast-radius budgets and kill-switch design, agent evaluation, and rollout governance are the book's Chapters 6–12 — and Appendix C's Approval-Gate Checklist and Audit-Log Schema travel with them. They live in the Part 2 companion pack; nothing here restates them, and this pack is complete and useful without them. (The Approval-Gate Checklist in Template 35 is Chapter 5's own fourteen-line standard — a different artifact from the Appendix C checklist of the same name, which is Part 2.)

Not general AI security. The companion AI Security in Production pack covers AI systems generally — threat modeling, injection defense, data protection. This pack is agents specifically: identity, inventory, and credentials for autonomous agents; least privilege for systems that act; sandboxing agent execution; human gates for agent actions. The two packs do not restate each other.

Not the cross-book security slice. The companion AI Security Templates & Checklists pack holds the MCP-and-enterprise-agents artifacts (OAuth deployment, tool-risk classes, the dangerous-call approval matrix). This pack is the dedicated agent-security book's deeper foundation — registry, workload identity, permission matrix, rubric, sandbox, gate — and deliberately does not restate them.

No runnable code or tooling. The book's registry record, policy file, and egress policy excerpts are simplified, structurally honest shapes. The pack ships the templates that specify, audit, and operate these components — not a working issuance service, policy engine, sandbox, or proxy.

No vendor or product guidance. The SPIFFE model appears as a reference design for structured agent identifiers — the idea, not a deployment guide. No security product is selected, installed, or configured here.

No guarantee of security. The book's own position: nothing in it is a guarantee that any system is secure. These templates bound, observe, and revoke delegated authority — and the sandbox section states plainly that containment does not stop an agent misusing access it legitimately holds.

Companion products

The AI Security Templates & Checklists pack is the cross-book companion — the MCP and enterprise-agent security slice this pack deliberately does not restate. AI Security in Production — Part 1 is the general-AI-security companion, from the sister book. Securing AI Agents — Part 2: Tool-Boundary Defense, Audit, Memory & Delegation Templates is this pack's sibling, built from Chapters 6–12 of the same book plus Appendix C's Approval-Gate Checklist and Audit-Log Schema: a companion for when you are ready for the second half — never a requirement for this pack to work. This pack stands alone.

Note: the $99 Architecture Templates Bundle currently contains Products #1–#3 only. This pack launches standalone; no bundle inclusion is promised for this product.

Built by the author of Securing AI Agents: Tool Permissions, Sandboxes, and Blast-Radius Control for Autonomous Systems, from the agent-security discipline behind production enterprise AI systems.

About the author

Naveen Kumar Josyula is the author of 35 AI books on Amazon KDP and the CEO and founder of AISoltrics Technologies Inc. He is the author of the source book, Securing AI Agents: Tool Permissions, Sandboxes, and Blast-Radius Control for Autonomous Systems, from which every template in this pack is distilled.

Support promise

If anything in this file is wrong or unclear, email support@aisoltrics.com before you judge it — we fix verified issues within one business day and send you the corrected file free. (You can also reach the founder's office at aadhya@aisoltrics.com.) Updates to this product are free to past buyers via your Payhip library. Sold by AISoltrics Technologies Inc.