Identity and permissions for customer-facing agents: a checklist

The risks to plan for

OWASP published its Top 10 for Agentic Applications on 9 December 2025.¹ Several entries matter most for customer-facing agents: agent goal hijack, where instructions hidden in documents or messages redirect the agent; tool misuse; identity and privilege abuse, where an agent holds more access than its task needs or a sub-agent inherits its parent’s access; and memory and context poisoning.¹²

Singapore’s agentic framework makes the same point from the governance side: limit an agent’s autonomy and its access to tools and data before deployment.³

The checklist

• Own identityEach agent has its own identity in your systems. It never borrows a staff login.
• Least privilegeAccess is scoped to the task. A billing-enquiry agent cannot read medical or HR data.
• Short-lived credentialsTokens expire, and sub-agents get their own narrower tokens.
• Read before writeNew agents start read-only. Write access is added one action at a time.
• Hard limitsCaps on refund amounts, number of changes and outbound messages.
• Confirmation for irreversible actionsThe customer or a staff member confirms cancellations, payments and account closures.
• Untrusted input stays untrustedText from emails, documents and web pages is treated as data and never as instructions.
• Separate memory per customerOne customer’s conversation cannot shape what the agent tells another.
• Full audit trailEvery action is logged with the agent’s identity, the customer and the reason.
• Owner and off switchA named person owns each agent and can stop it within minutes.

An example from payments

Card networks apply the same idea. Mastercard issues an Agentic Token to each agent, so the agent never handles the card number and its activity can be traced and limited.⁴ Service teams can borrow the pattern: an identity per agent, with limits attached to the identity.

For financial institutions

MAS expects controls proportionate to risk across the AI life cycle, including human oversight and cybersecurity, and holds institutions accountable for AI from third parties.⁵ The checklist above gives a starting set of controls to record against each agent in the AI inventory.