Agentic AI Security Policy Template for AI Agents

Most organisations have policies for users, service accounts and acceptable use of AI tools. Few have a policy that says how AI agents get access, who is accountable for them and what they may do on their own. This template gives you a starting point. It sets out policy statements for registering, identifying, authorising, overseeing, monitoring and retiring AI agents, written so it can sit alongside your existing identity, access and information security policies. Adapt the wording, roles and thresholds to your organisation, and have it reviewed by your legal, risk and compliance teams before adoption.

How to use this template

Replace text in square brackets, such as [Organisation] and [Security team], with your own terms.
"Must" indicates a mandatory requirement; "should" indicates a recommended practice where exceptions may be justified.
Align defined roles with your existing governance structure, for example the information security, IAM and AI governance functions.
Link each statement to the standards and procedures that implement it. Our guides referenced at the end cover the implementation detail.
Review the policy at least annually; agent technology and regulation are changing quickly.

1. Purpose

This policy sets the requirements for the secure use of AI agents at [Organisation]. It ensures that every AI agent is known, owned, uniquely identified, given only the access it needs, subject to appropriate human oversight, monitored and retired securely, so that [Organisation] can benefit from AI agents while managing the risks to its data, systems, customers and obligations.

2. Scope

This policy applies to all AI agents that access [Organisation] systems or data, or act on behalf of [Organisation], its employees or its customers, including:

Agents developed internally, on any platform or framework.
Agents built by staff using low-code or no-code agent platforms.
Agents and AI features provided by third parties that access [Organisation] systems or data, including through OAuth grants or API keys.
AI coding assistants and agents used in software development.
Tools, MCP servers and integrations used by agents.

It applies to all employees, contractors and third parties who create, deploy, own, operate or approve AI agents.

3. Definitions

AI agent: software that uses an AI model to decide on and take actions, such as calling tools or APIs, towards a goal, with or without human approval of each step.
Agent owner: the named individual accountable for an agent's purpose, access, behaviour and retirement.
Agent identity: the unique non-human identity under which an agent authenticates.
Principal: the user or system on whose behalf an agent acts.
High-impact action: an action that is irreversible, moves money, changes access rights, deletes or bulk-exports data, communicates externally on behalf of [Organisation], or affects production systems. [Organisation] maintains the detailed list in [procedure reference].
Agent registry: the system of record for AI agents at [Organisation].
MCP server: a server implementing the Model Context Protocol that exposes tools, resources or prompts to AI agents.

4. Roles and responsibilities

[AI governance body]: approves this policy, sets risk appetite for AI agents and approves high-risk agent deployments.
[Chief Information Security Officer]: owns this policy, and the security standards and monitoring that implement it.
[IAM team]: operates the agent registry, issues agent identities and credentials, and runs access reviews.
Agent owners: register agents, justify access, review access, respond to alerts and retire agents.
Developers and builders: build and configure agents in line with this policy and its standards.
[Security operations]: monitor agent activity and respond to agent-related incidents.
[Procurement and third-party risk]: assess AI vendors, agent platforms and third-party tools.

5. Policy statements

5.1 Registration and ownership

Every AI agent must be registered in the agent registry before it receives access to any production system or data.
Each registration must record the agent's purpose, owner, principal type (itself, users, or both), tools, data sources, credentials, autonomy level and risk rating.
Every agent must have a named owner who is a current employee. If an owner leaves or changes role, ownership must be transferred within [X] days or the agent must be suspended.
Agents that are discovered but not registered must be treated as unauthorised and are subject to suspension.

5.2 Identity and authentication

Each agent must have its own unique identity. Agents must not share identities or credentials with other agents, workloads or people.
Agents must not authenticate using an individual's personal credentials, including passwords, personal access tokens or session cookies.
Agent credentials should be short-lived and issued by a platform (for example, workload identity or token services) rather than stored as static secrets.
Where static credentials cannot be avoided, they must be stored in [approved secrets manager], scoped to least privilege, set to expire within [X] days and rotated.
Credentials must not be placed in prompts, agent memory, source code, configuration files in repositories, notebooks or container images.

5.3 Access and authorisation

Agents must be granted only the access required for their registered purpose (least privilege) and only the tools required (least agency).
Agents must not hold administrative, owner or wildcard permissions in any production system without [AI governance body] approval.
Access should be scoped to the task and issued just in time where the platform supports it.
Controls restricting agent behaviour must be enforced by the platform, gateway or target system. Instructions in prompts are not an acceptable sole control.
Agent access must be reviewed by the owner at least [quarterly for high-risk agents / annually for others], and whenever the agent's model, instructions, tools or autonomy change.

5.4 Acting on behalf of users

An agent acting on behalf of a user must never exceed that user's access.
Delegated access must be limited to the scopes needed for the task, and should identify both the user and the agent to downstream systems.
Agents and tools must not forward a user's access token to other services; each service must receive a token issued for it.
Users must be able to see and revoke the access they have delegated to agents.

5.5 Human oversight

High-impact actions must require approval by an authorised person before execution, unless an exception is approved by [AI governance body].
Approval must be enforced technically, and the approver must be shown the actual action, target and parameters.
Each agent's autonomy level, and the actions it may take without approval, must be recorded in the registry.

5.6 Tools, MCP servers and integrations

Agents may only use tools, MCP servers, plugins and agent frameworks on the [approved list].
Remote MCP servers must require authorisation and must validate that tokens were issued for them.
Tool definitions and descriptions must be treated as untrusted input; changes to approved tools must be reviewed before use.
Code execution by agents must take place in a sandbox with restricted file system and network access.
Communication between agents must be authenticated and protected in transit.

5.7 Data protection

Agents must only access data classified up to [classification] unless approved in their registration.
Retrieval by agents must respect the access rights of the user on whose behalf they act.
Agent memory must be isolated per user and per session where agents serve multiple users, and retained for no longer than [period].
Use of agents to process personal data must comply with [data protection policy].

5.8 Logging and monitoring

Every agent action must be logged with the agent identity, principal, tool or API used, credential identifier, authorisation decision, approvals and outcome.
Agent logs must be protected against tampering, handled according to the classification of the data they contain, and retained for [period].
[Security operations] must monitor agent activity for anomalous behaviour, including use of new tools or data, unusual volumes, repeated permission errors, credential discovery and destructive actions.

5.9 Incident response

Every production agent must be capable of being stopped, and all its credentials and grants revoked, within [X] minutes.
This capability must be tested at least [annually] for high-risk agents.
Agent-related incidents must be handled under [incident response procedure], including assessment of notification obligations.

5.10 Third-party agents and AI services

Third-party AI services and agent platforms that access [Organisation] data must be assessed under [third-party risk procedure] before use.
Users must not grant third-party AI applications access to [Organisation] data beyond [low-risk scopes] without approval.
Contracts must address data use (including use for model training), security of credentials held on [Organisation]'s behalf, and incident notification.

5.11 Development and testing

Agents must be threat modelled before receiving production access, and again after significant change.
High-risk agents must be tested for prompt injection, privilege escalation and data exfiltration before deployment.
Development and test agents must not use production credentials or production data without approval.
AI coding agents must run with scoped credentials and must not have direct access to production deployment credentials.

5.12 Retirement

When an agent is no longer needed, the owner must request retirement.
Retirement must revoke all credentials, tokens and grants, remove the agent from discovery and routing, archive its logs and update the registry.
Agents with no activity for [X] days must be reviewed and suspended if no longer required.

6. Exceptions

Exceptions to this policy must be requested by the agent owner, risk assessed by [Security team], approved by [approver], recorded with compensating controls and an expiry date, and reviewed before expiry.

7. Compliance

Compliance with this policy will be monitored through the agent registry, access reviews, security monitoring and internal audit. Agents found to be non-compliant may be suspended. Breaches of this policy by staff may be handled under [disciplinary procedure].

[Information Security Policy]
[Identity and Access Management Policy]
[Non-Human Identity Standard]
[Acceptable Use of AI Policy]
[Data Protection Policy]
[Third-Party Risk Management Procedure]
[Incident Response Procedure]

9. Review

This policy is owned by [policy owner] and will be reviewed at least annually, or sooner following significant changes in technology, regulation or [Organisation]'s use of AI agents.

Implementation guidance

Each section of this template is supported by a detailed NHI Mgmt Group guide:

Registration, identity and retirement: Agentic AI Identity Guide
Access and authorisation, human oversight: AI Agent Authorisation Guide
Tools and MCP servers: MCP Security Guide
Agent-to-agent communication: Multi-Agent and A2A Security Guide
Logging, monitoring and incident response: AI Agent Observability and Incident Response Guide
Third-party and shadow AI: Shadow AI and AI Agent Discovery Guide
Threat modelling: Threat Modelling AI Agents
Coding agents: AI Coding Agents Security Guide
Regulatory mapping: Agentic AI Compliance Guide

This template is provided for guidance and must be adapted to your organisation. It is not legal advice. Related NHI Mgmt Group resources: Agentic AI Identity Maturity Model · NHI Lifecycle Management Guide · IAM and IGA Basics

Agentic AI Security Policy Template