News · Academy · November 12, 2026

Academy: ten guardrails every AI agent needs

Six governments told organisations how to adopt agentic AI in May 2026. Ten controls to set before an agent gets access, with the sources.

DRIVE 369 DAO · 3 min read

Academy, organisations, lesson 6. An AI agent is software that reads, decides and acts. When it can reach your mail, files, cloud or money, one hidden instruction can cost a lot. This lesson is a checklist to complete before you switch one on.

The sources

• The joint guidance Careful adoption of agentic AI services, from CISA, the NSA and the cyber agencies of Australia, Canada, New Zealand and the UK (May 2026). It says to treat agentic AI as part of your existing zero-trust and least-privilege programme.
• The OWASP Top 10 for LLM applications, which includes prompt injection, excessive agency and unbounded consumption, and OWASP's Top 10 for agentic applications (December 2025).
• The Model Context Protocol's own security best practices.

Ten guardrails

1. Least privilege. Give the agent the narrowest permissions that do the job, and no wildcard scopes. Start small and expand.
2. Short-lived credentials. Prefer temporary, per-request credentials to long-lived keys.
3. Human approval for high-impact actions: sending money, changing access, deleting records, network egress. The operator sets the rule, never the agent.
4. Treat outside text as hostile. Mail, web pages, calendar invites, issue titles and form fields can carry instructions. Keep them marked as data, not commands, and never let them widen the agent's permissions.
5. Do not rely on the system prompt for safety. The joint guidance is explicit that system prompts are not security controls.
6. Allow-list tools. Approve third-party tools and MCP servers before use, show the exact command a local server will run, and block internal and metadata addresses.
7. Sandbox first. Run in a test environment, test with adversarial inputs, and roll out in phases with graduated autonomy.
8. Log every tool call, memory read and decision in a form a person can read, and protect the logs from tampering.
9. Limits and an off switch. Budgets on calls and spending, rate limits, and a way to stop the agent, restrict its permissions and roll back. (The guidance describes interrupt, fail-safe and automatic permission restriction rather than a single "kill switch".)
10. Watch for drift. Alert when the agent does something outside its usual pattern.

Real cases that show why

A calendar invite steered Google's Gemini into leaking private meeting summaries, and text in public forms made Microsoft Copilot and Salesforce Agentforce return corporate data (briefing). In August the ChainDrop worm planted configuration files for AI coding assistants into repositories to spread (briefing).

How Ghostdrive approaches it

This is where our architecture is built for the job. Every use of your memory by an AI is under a signed grant with a purpose and expiry, and leaves a receipt. Paying, signing in, adding a recipient and deleting always ask you. The Crew gateway gives each connected AI its own token and scopes, has no permission to send, pay, sign or publish, logs every call per client, has a stop switch and a budget in calls. Strangers' text is fenced as other people's words. Honest limit: a model can still be misled, so the limits are on what it can do. How Crew works.

Academy: start here · Prompt injection briefing · Cloudflare and AI for security