Secure, govern, and deploy multi-agent solutions
Security and governance questions test identity, least privilege, data protection, and lifecycle control. Know that each agent and each tool connection should have its own identity and scoped permissions - a shared broad credential across agents is a red flag. Understand managed identities for service-to-service auth, secrets in a managed vault rather than code or prompts, and network isolation through private endpoints and virtual networks. Recognize prompt injection as the top agentic threat: untrusted content retrieved by a tool can hijack instructions, so treat retrieved documents and tool outputs as untrusted input, constrain tool capabilities, and require approval for high-impact actions.
Governance covers content safety filters, data residency, logging and audit trails, and responsible AI review. Deployment covers environment promotion (dev to test to prod), versioning of agent definitions and prompts, canary or blue-green rollout, and rollback. Understand that agent configuration changes are deployments and must be versioned and gated like code.
Traps: assuming the model provider's safety filters cover your tool side effects; granting an agent write access when read suffices; storing secrets in prompt instructions; and treating prompt or tool changes as configuration rather than a versioned release. Another trap is missing audit logging of tool invocations, which breaks incident response and compliance.
Rule of thumb: apply the same rigor to agents as to privileged service accounts - dedicated identity, least privilege, no secrets in prompts, every tool call logged, and every change versioned and promotable.
Worked example: an agent that reads HR documents should use a managed identity with read-only scope on one index, no write tools, retrieval results treated as untrusted, and full audit logging of queries; the agent definition is versioned and rolled out to a canary group before full promotion, with a documented rollback to the prior version.