# Agent setup self-check

Answers stay in your browser. This is not a security certification.

- [ ] Does it have write or delete access to production data?
  Remove unnecessary production write access; use scoped permissions and recoverable workflows.

- [ ] Can it spend money or send messages without approval?
  Require approval for consequential external actions.

- [ ] Does it read untrusted content while having tool access?
  Treat external content as data; isolate tool authority and check action scope.

- [ ] Is there an action log?
  Keep tamper-resistant action logs and monitor unexpected tool use.

- [ ] Can you stop it instantly?
  Maintain an operator-controlled stop mechanism outside agent permissions.

- [ ] Are credentials scoped to only what it needs?
  Use least privilege and short-lived credentials.

- [ ] Do irreversible actions require human confirmation?
  Enforce confirmation in the tool layer, not only in a prompt.

- [ ] Is it tested in a sandbox before production?
  Test before release and verify sandbox boundaries; sandboxing alone is insufficient.

Sources: OWASP https://owasp.org/projects/top-10-for-large-language-model-applications ; NIST https://www.nist.gov/itl/ai-risk-management-framework