Agent Hardening

In the previous rooms, you explored how AI agents can be discovered, designed, and implemented for NorthStar Fashion. You also saw how an investigation agent can retrieve alerts, search SIEM logs, use organisational context, call external services, and maintain conversational state.

This room focuses on the final stage of the agent lifecycle: hardening.

NorthStar Fashion has developed a Security Investigation Agent to assist SOC analysts during alert investigations. The agent can gather evidence, search related logs, retrieve organisational context, check IP reputation, and produce an investigation verdict and recommendation.

However, an agent can behave incorrectly even when its system instructions appear secure.

Retrieved documents may contain malicious instructions. External tool outputs may include untrusted content. Memory can preserve misleading information across investigations. Broad tool permissions can expose more data than the agent needs. Legitimate authorisation records can also be misinterpreted if the agent treats partial matches as proof.

For this reason, securing an agent requires more than adding instructions such as "ignore malicious prompts".

Security controls must also define:

• What information the agent can trust
• What tools it can access
• What data those tools may retrieve
• What information can persist in memory
• How evidence and authorisation are validated
• When a human analyst must remain in control

In this room, you will review a deliberately vulnerable version of the NorthStar Security Investigation Agent and investigate these weaknesses through the Agent Security Review Portal.

You will not need to write or modify code. Instead, you will inspect examples from the real implementation, analyse traces and evidence, identify broken trust boundaries, and select appropriate hardening controls.

Learning Objectives

By the end of this room, you will be able to:

• Identify key trust boundaries in AI agent workflows.
• Recognise indirect prompt injection and poisoned context.
• Evaluate tool permissions and untrusted tool outputs.
• Explain how conversation memory can influence later decisions.
• Apply practical guardrails to context, execution, memory, and decisions.
• Use agent traces to investigate unsafe behaviour.
• Map agent security weaknesses to relevant OWASP Agentic Top 10 risks.

Prerequisites

Before starting this room, you should have a basic understanding of the following:

• AI agent concepts, tool calling, and retrieval-augmented generation (RAG)
• SOC concepts such as alerts, logs, and authentication events

It’s also recommended that you complete the previous rooms for additional context. However, this room can be completed independently and includes all the configurations, traces, evidence, and challenge data required.

• Agent Discovery
• Agent Design
• Agent Foundations
• Agent Building
• Agent Evaluation