A trusted employee. An overprivileged agent.
A CISO guide to unmanaged agent access, MCP proxy boundaries, prompt injection, and production gates.
The decision in brief
Use a proxy to govern a known route, then assess the residual risks around content, clients, providers, and bypass.
Start with the observation boundary
Security reviews often begin with the word “agent” as if it names one controlled system. In practice, an agent may combine a model, client, local server, remote MCP server, browser, and upstream credentials. A proxy governs the requests that reach its endpoint. That boundary is valuable precisely because it is specific.
State what is outside it: direct provider calls, unmanaged clients, browser actions, shell commands, and model-provider handling of returned tool results. This makes the control review honest and directs compensating controls to the right owners.
Illustrative scenario: a convincing tool result
Imagine a routed tool returns a document containing instructions that tell the model to disable a control or reveal data. The proxy can still require identity, policy, and approval before a write, but it cannot decide whether every piece of content is trustworthy. The scenario is illustrative, not a reported breach.
Prompt injection defenses belong across the model, client, application, and human approval path. Treat a proxy as one layer in defense in depth, with production gates for dangerous actions and a way to inspect uncertain outcomes.
Security review checklist
Ask for evidence that maps the control to a request and its outcome:
- Is identity verified at the final authorization check, including current membership or revocation?
- Are upstream credentials scoped to the connection and audience, with consent kept distinct from gateway login?
- Are tool and resource mappings reviewed, versioned, and denied when coverage is unknown?
- Are sensitive writes independently approved against exact arguments, schema, policy, expiry, and use count?
- Does the audit record distinguish policy outcome from execution outcome, including uncertainty?
- Can the team demonstrate direct-path and bypass testing for the intended deployment?
What Durin can support
Durin’s governed path covers default-allow authorization checks, optional write review or disallow controls, scoped connections, and audit. Evaluation workspaces support decision-model review. Public trust copy does not claim a certification, production SLA, or residency guarantee.
That distinction is useful in a CISO review: evaluate the decision model and evidence path, then verify identity, provider, network, retention, recovery, and operational proof for the production path.