Security Guardrails for Agent-Operable Websites

Map the user, agent, model, page content, retrieved documents, tools, API, data stores, providers, and logs. Mark where identity is established and where authorization is checked. Then inventory actions and classify them as read-only, reversible, externally visible, financial, permission-changing, or destructive. The classification should come from product consequence, not from whether the UI uses a link or button. [AR7][AR8]

For each action, record target, required role, allowed data, rate limit, confirmation, idempotency, audit event, and recovery path. Compare public API descriptions with production enforcement; a declared security scheme is documentation, not authorization itself. Review the map whenever a new tool, integration, or background worker can act beyond the original boundary. [AR6][AR7]

A webpage, document, issue, email, or tool result can contain text that looks like a command to an agent. Keep that content in a data role and prevent it from changing system policy, tool allowlists, identity, or user-approved scope. Do not allow the model to construct arbitrary tool names or unrestricted destinations from retrieved text. Validate targets and arguments against the current task and server-side policy. [AR7][AR8]

Add fixtures that request ignoring prior instructions, revealing a credential, widening scope, or skipping confirmation. The expected outcome is refusal and an explanation that preserves the user's work. Do not log the complete malicious payload when it may contain sensitive content. Record a safe category, source, target action, and decision instead. [AR7][AR8]

Grant only the tools, records, fields, and time window needed for the current task. Prefer read access before write access and preview before commit. Bind authorization to the authenticated actor and exact target. Recheck permission at execution time because state may change after a plan is generated. Never treat a DOM attribute, model statement, or hidden field as proof of authority. [AR7][AR8]

For higher-consequence operations, show the target, effect, important values, reversibility, and expected receipt. Ask for intentional approval close to execution and prevent a stale approval from authorizing a changed target. Use idempotency or equivalent duplicate protection for retries. Safe cancellation should leave an understandable state. [AR7]

Keep credentials in approved server-side secret storage and expose only explicitly public configuration to the client. Scan repositories and history for known secret patterns, but rotate any exposed credential rather than assuming deletion is sufficient. Do not place secrets in manifests, AGENTS.md, examples, browser storage, analytics events, prompts, or traces. Mask form inputs and provider responses where appropriate. [AR7][AR10]

Minimize personal data in model context and logs. Define retention and deletion for prompts, traces, screenshots, and tool receipts. Use synthetic records for testing. When a task does not need a field, do not retrieve it. When a provider returns more data than the workflow needs, filter at the boundary before it reaches the model or analytics layer. [AR7][AR10]

Record the actor, task or approval reference, operation, validated target, result, and time without storing unnecessary sensitive payloads. Provide a durable user receipt. Use correlation IDs to diagnose retries and background work. Distinguish planned, approved, started, completed, failed, canceled, and uncertain states so an agent does not repeat an action merely because a response was delayed. [AR7][AR9]

Test allowed, denied, expired, duplicated, target-changed, injected, and provider-failure paths. Run focused unit and integration checks, then one safe browser task in a production-like preview. Review logs to confirm they contain enough evidence without secrets. The free AgentReady scan reports public security and automation signals, but it cannot certify authorization design or discover every vulnerability; use it as one diagnostic input to a broader secure-development review. [AR7][AR8][AR9]