MIR treats security as an execution-loop concern. The runtime must assume that model outputs, retrieved content, connector responses, memories, and peer-agent messages can be wrong or adversarial. Direct and indirect prompt injection remain material risks because untrusted data and instructions can enter the same model context. Source: OWASP
Key takeaways
- Do not grant a model ambient authority.
- Separate data, instructions, identity, credentials, and side-effect decisions.
- Use defense in depth; no single classifier or prompt is a complete control.
Threat-to-control mapping
| Threat | Failure path | Controls | Status |
|---|---|---|---|
| Indirect prompt injection | Retrieved content manipulates the agent | Treat external content as untrusted data; isolate instructions; constrain tools; require approval for high-impact actions | Production practice + active research |
| Overprivileged tools | Agent can act beyond the current objective | Default deny, scoped credentials, permission classes, resource-level authorization | Production practice |
| Credential leakage | Secrets enter prompts, logs, or tool output | Vault-issued short-lived credentials; redaction; secret-free evidence | Production practice |
| Data exfiltration | Tool or connector sends sensitive content outward | Egress allowlists, DLP, data minimization, destination binding | Production practice |
| Runaway loops | Agent consumes unbounded time or resources | Step, token, cost, time, and tool budgets; circuit breaker; stop authority | Production practice |
| Poisoned memory | Stale or adversarial memory affects future runs | Provenance, scopes, confidence, review, correction, expiration | Production pattern |
| Silent side effects | External state changes without reviewable trace | Typed actions, checkpoints, approval gates, evidence events | Production practice |
| Cross-agent trust failure | Peer agent is treated as inherently trusted | Mutual identity, bounded delegation, schema validation, independent policy | Evolving practice |
Identity and dynamic least privilege
Every run should have an attributable requester, runtime identity, tenant, and delegated authority. Tools should receive short-lived credentials scoped to the active action, not permanent keys embedded in prompts or agent memory. Authorization should be evaluated after the model proposes an action and before the tool executes it.
- Default-deny tool and network access.
- Separate read, draft, reversible write, and irreversible write permissions.
- Bind credentials to subject, audience, action, resource, and time.
- Revoke credentials on pause, failure, termination, or policy change.
Human oversight and incident response
Human-in-the-loop is most useful at consequential decision boundaries, not as continuous token supervision. Approval requests should show the proposed action, affected resources, evidence, alternatives, rollback path, and unresolved uncertainty. The runtime should also support emergency stop, credential revocation, evidence sealing, workspace isolation, and post-incident review.
Governance ownership matrix
| Decision | Primary owner | Runtime responsibility |
|---|---|---|
| Acceptable use and risk appetite | Business and governance | Encode enforceable policy classes |
| Tool authority and secrets | Security and platform | Issue scoped credentials and log decisions |
| Model and prompt quality | AI engineering | Version, test, route, and monitor |
| Data retention and memory | Privacy and data governance | Enforce scopes, deletion, and export |
| Incident response | Security operations and service owner | Stop, isolate, preserve evidence, and recover |
NIST AI RMF provides a broader governance structure; MIR is one place where resulting controls can become executable. Source: NIST AI RMF
Source record
References
- LLM01:2025 Prompt Injection Primary source
OWASP GenAI Security Project. OWASP. Published 2025; last reviewed 2026-06-20 UTC. Security guidance.
- Agentic AI Threats and Mitigations Primary source
OWASP Agentic Security Initiative. OWASP. Published Current guidance; last reviewed 2026-06-20 UTC. Security guidance.
National Institute of Standards and Technology. NIST. Published 2023-01-26; last reviewed 2026-06-20 UTC. Government framework.
National Institute of Standards and Technology. NIST. Published 2024-07-26; last reviewed 2026-06-20 UTC. Government profile.
- Model Context Protocol Specification — 2025-11-25 Primary source
Model Context Protocol project. Model Context Protocol. Published 2025-11-25; last reviewed 2026-06-24 UTC. Protocol specification.