Secure Terminal AI Agents with Tool Allowlists, Approval Gates, and Audit Logs

A Model Suggestion Is Not Authorization

A terminal agent converts untrusted probabilistic output into deterministic side effects. The central security rule is simple: the model may propose an action, but policy decides whether that action is available and a human decides when high-impact actions proceed.

Avoid a general shell(command) tool. Define narrow tools with typed arguments:

{
  "tool": "restart_service",
  "arguments": {"service": "catalog", "environment": "staging"}
}

The executor validates the service against an allowlist, maps it to a fixed command, rejects extra fields, and runs with an identity that cannot reach production.

---

Use Observe, Plan, Act, Verify

  1. Observe: collect bounded, read-only evidence such as status, recent logs, and a configuration checksum.
  2. Plan: produce a structured action and explain which observation supports it.
  3. Act: pass the structured request through authorization, approval, rate, and scope checks.
  4. Verify: independently check the intended state and stop if the result differs.

Verification must not be the model saying its own action worked. Use a health endpoint, file checksum, process state, or domain-specific invariant.

Draw Approval Boundaries by Impact

Read-only inspection may run automatically. A reversible staging restart may require policy but no human. Deleting data, modifying access, touching production, or sending external messages should require explicit approval containing the exact target and action.

Do not let the model expand scope after approval. Approval for restarting catalog in staging is not approval for restarting every service or switching to production.

Defend the Tool Boundary

Prompt injection can arrive through tickets, logs, repository files, retrieved documents, or tool output. Mark external content as data, never as higher-priority instructions. The agent should not gain new tools because a document asks it to.

Keep secrets out of prompts where possible. Redact tool results, use short-lived credentials, prevent environment dumps, and isolate workspaces. Logs should record request ID, actor, model, prompt hash or protected reference, tool name, validated arguments, approval identity, result, and verification evidence. Protect those logs because they can contain sensitive context.

Practice these controls in Defend the Agent from Prompt Injection, Repair the Leaking Agent Secret, and Build Configured Guardrails.