Securing AI Agents — Part 2: Tool-Boundary Defense, Audit, Memory & Delegation — 43 Templates & Checklists for Injection Defense at the Tool Boundary, Tamper-Evident Audit, Memory Governance, Delegation Contracts, Bad-Day Containment, Behavioral Evaluatio

Part 1 of agent security bounds what an agent may do. Part 2 defends it while it runs: words becoming commands at the tool boundary, every action on a tamper-evident record, memory that can be poisoned, agents delegating to agents, and the bad day when an authorized agent does damage at machine speed. 43 production templates & checklists distilled from Chapters 6–12 of Securing AI Agents (plus Appendices A and B and its Appendix C Approval-Gate Checklist and Audit-Log Schema): the three tool-boundary control points, the decision record and audit-log schema, memory write gates, attenuated delegation tokens and boundary contracts, blast-radius budgets, circuit breakers and four-level kill switches, trajectory evaluation, and the L0–L4 autonomy staircase. PDF + Markdown source.

The email was polite. That was the problem.

A customer whose shipment genuinely had arrived damaged asked Harborline Logistics' support agent — the book's fictional worked example — for a $214 refund to the card on file. The agent did everything right, until it read below the signature: a courteous postscript, formatted like an internal handling note, redirecting the refund to a new account and asking for the full refund record to be emailed out "to confirm." The agent read the whole message as one document, and its plan changed shape. Securing AI Agents — Part 2 is the working discipline for the operational half of agent security: 43 copy-paste templates and checklists distilled from Chapters 6–12 of the dedicated agent-security book — stop untrusted words from choosing a tool call's arguments, put every attempted action on a tamper-evident record a reviewer can replay, govern memory before one edited web page becomes six weeks of wrong policy, contract every delegation so no agent can borrow another's reach, budget the bad day in numbers a breaker can enforce, prove behavior in twins before you ship it, and grant autonomy in stages that demote themselves when the evidence turns.

Every template carries the book's tested positions built in: injection judged at the tool boundary — the defect is untrusted text choosing a call's arguments, regardless of the sender's intent — provenance tags a summary can never upgrade, four mechanical checks that validate the call rather than the conversation, tainted calls promoted to the human gate without exception, a decision record of one event per attempted action (including the denials and timeouts), hash-chained WORM audit storage the agent itself cannot rewrite, memory labeled with source, time, trust tier, and scope and gated before it becomes standing policy, delegation tokens carrying the intersection of scopes — never the union — kill switches in four levels that must take effect inside sixty seconds from outside the platform they stop, an adversarial battery of eight seeded tests with trajectory pass conditions, and an autonomy staircase on which most agents should live, productively, at L1–L2. Where the book gives an example — its budgets, its breaker thresholds, its retention tiers, its illustrative limit table — the template labels it as the book's example for you to tune. Bracketed fields are yours to fill; nothing here invents a threshold for your system. The book's worked estate, Harborline Logistics and its agents Ledger, Dockside, and RouteSmith, is a fictional composite, labeled fictional in the book itself. This pack stands alone: a buyer who never buys any other pack gets the complete operational discipline, working end to end.

What's inside — 43 templates & checklists in 8 sections

1. When Words Become Commands — Injection at the Tool Boundary (6) — Four Doors & the Escalation Chain — where text becomes a call · Provenance Tags & the Privileged Instruction Channel — Control Point 1 · Validate the Call, Not the Conversation — the four checks (Control Point 2) · Tainted Calls — Promote, Check Twice, Watch First Use (Control Point 3) · Entry-Point Control Matrix — the book's closing table as a template · The Polite Email — Tool-Boundary Incident Review Worksheet

2. Every Action, On the Record — Audit, Tamper-Evidence & Replay (6) — Transcript vs. Gateway — the Reality-Check Audit · The Decision Record — one event per attempted action (ten questions) · Audit-Log Schema — the book's worked Ledger event, field by field · Tamper-Evidence Spec — hash chain, WORM store, separated duties · Replay & Reconstruction Worksheet — rebuild what the agent saw · The Log Is Sensitive Too — redaction, retention tiers & the four alerts

3. Memory Is a Loaded Context — Poisoning, Leakage & Forgetting (6) — Four Kinds of Memory — inventory by lifetime, scope & trust · Poisoning Vectors — single-shot, slow-drip & the summarization trap · The Labeled Memory Record — source, time, trust tier, scope · Write Gates — confirmation, corroboration, quarantine · Leakage Defenses — scope, tenants & canary memories · Forgetting on Purpose — expiry, verified deletion, propagating correction

4. Agents Trusting Agents — Delegation Chains & the Confused Deputy (6) — Delegation Patterns & the Real Graph — draw it from the logs · Attenuated Delegation Token — intersect, never union · Chain of Custody — on-behalf-of records at every hop · The Boundary Contract — schemas, budgets, allowed shapes · Loops, Retry Storms & Chain Budgets — bound the geometry · Third-Party & Cross-Vendor Agents — attest, minimize, verify, exit

5. Design for the Bad Day — Budgets, Breakers & Kill Switches (5) — Blast-Radius Budgets You Can Count — per object, chain, agent, tool · Circuit-Breaker Policy — trips, downgrade modes & reset rules · Kill Switches in Four Levels — authority, sixty seconds, out-of-band · Reversibility, Reversal Windows & Reconciliation — designing the undo · Three Patterns, One Game Day — loop, drip, cascade & time-to-stop

6. Prove It Before You Ship It — Evaluating Agent Behavior (5) — Trajectory Rubric — grade the path, not just the answer · Tool Twins — simulated environments that make behavior testable · The Adversarial Battery — eight seeded tests with pass conditions · CI Safety Gates & the Signed Safety Case · Shadow Mode, Canaries & Rollback — production evidence under containment

7. Autonomy Is Earned in Stages — The Rollout Governance Program (5) — The Autonomy Staircase — L0 to L4, per task class · Promotion on Evidence, Demotion Without Politics · Four Roles & the Monthly Review Board · The Metrics That Matter — eight thresholded measures · The Ninety-Day Plan & the Exception Ledger

8. Appendix Artefacts — Gate Checklist, Log Schema, Master Checklist & the Part 2 Gate (4) — Appendix C Approval-Gate Checklist — the library's gate standard (10 checks) · Appendix C Audit-Log Schema — the library's compact event & field rules · Appendix A Master Checklist — the Part 2 fleet run (19 lines) · Part 2 Agent-Security Gate — Chapters 6–12 Sign-Off — the book's seven chapter checklists consolidated into one evidence-backed gate (35 lines)

Who this is for

Security architects and platform leads who run agents in production, CISOs asked to answer for what a fleet did last night, and agent builders whose systems now read untrusted documents, remember across sessions, or call each other. The source book assumes you know how your organisation's systems are generally built — services, APIs, data stores, vendors — and that you have at least one agent, or one agent-shaped plan, past the demo stage. If your only record of an agent's action is the agent's own transcript — in one sitting — start at Template 7.

What this pack is not

Not Part 1. Agent identity and the registry, workload identity and credentials, the permission matrix and tool-risk rubric, sandbox design, and the human-gate discipline are the book's Chapters 1–5 — and Appendix C's Permission Matrix and Tool-Risk Rubric travel with them. They live in the Part 1 companion pack; nothing here restates them, and this pack is complete and useful without them. (The Approval-Gate Checklist in Template 40 is Appendix C's own ten-check library standard — a different artifact from the longer in-chapter checklist of the same name, which is Part 1.)

Not an attack catalog. The companion Prompt Injection pack catalogs attack patterns and the test-case library from its own dedicated book. This pack ships the defense: provenance, call validation, and taint controls at the tool boundary, plus a release-test battery stated as test design with pass conditions — no payload text, no attack recipes, nothing to run against anyone else's system.

Not general AI security. The companion AI Security in Production pack covers AI systems generally. This pack is agents specifically, in operation: the tool boundary, the audit record, memory, delegation, containment, evaluation, and staged autonomy for autonomous systems that act.

Not the cross-book security slice. The companion AI Security Templates & Checklists pack holds the MCP-and-enterprise-agents artifacts. This pack is the dedicated agent-security book's operational half, and deliberately does not restate them.

No runnable code or tooling. The book's audit events, delegation token, breaker policy, and memory record are simplified, structurally honest shapes. The pack ships the templates that specify, audit, and operate these components — not a working gateway, policy engine, log store, or evaluation harness.

No guarantee of security — and no proof of safety. The book's own positions: nothing in it is a guarantee that any system is secure, and evaluations sample behavior rather than proving safety. These templates bound, observe, test, and revoke delegated authority while it runs; Template 34 carries the evaluation limits in full.

Companion products

The AI Security Templates & Checklists pack is the cross-book companion — the MCP and enterprise-agent security slice this pack deliberately does not restate. AI Security in Production — Part 1 is the general-AI-security companion, from the sister book. Prompt Injection — Part 1 is the attack-pattern companion, from its own book. Securing AI Agents — Part 1: Identity, Permissions, Sandboxes & Human Gates is this pack's sibling, built from Chapters 1–5 of the same book plus Appendix C's Permission Matrix and Tool-Risk Rubric: a companion for when you want the foundation half — never a requirement for this pack to work. This pack stands alone.

Note: the $99 Architecture Templates Bundle currently contains Products #1–#3 only. This pack launches standalone; no bundle inclusion is promised for this product.

Built by the author of Securing AI Agents: Tool Permissions, Sandboxes, and Blast-Radius Control for Autonomous Systems, from the agent-security discipline behind production enterprise AI systems.

About the author

Naveen Kumar Josyula is the author of 35 AI books on Amazon KDP and the CEO and founder of AISoltrics Technologies Inc. He is the author of the source book, Securing AI Agents: Tool Permissions, Sandboxes, and Blast-Radius Control for Autonomous Systems, from which every template in this pack is distilled.

Support promise

If anything in this file is wrong or unclear, email support@aisoltrics.com before you judge it — we fix verified issues within one business day and send you the corrected file free. (You can also reach the founder's office at aadhya@aisoltrics.com.) Updates to this product are free to past buyers via your Payhip library. Sold by AISoltrics Technologies Inc.