Concept · 6 min read
Security Considerations for AI-Assisted Engineering
AI assistants and agents introduce new identities, new data flows and new ways for untrusted input to influence actions. Model them like any other system.
Agents are identities
An AI agent that can call tools or APIs acts with some set of credentials. Treat it as a service identity: scope its permissions, log its actions, and include it in access reviews.
Untrusted input reaches decisions
Content an agent reads — documents, tickets, web pages, tool output — can contain instructions. Design so that such content cannot, on its own, trigger privileged actions.
Separate reading from acting. Require explicit human approval for changes that affect production, data access or permissions.
New data flows
Prompts and context may carry source code, secrets or customer data to model providers. Map those flows, minimize what is sent, and understand retention terms before connecting sensitive systems.
Explainability as a control
AI-assisted recommendations should cite the evidence they rely on. A reviewer who can see the reasoning can catch errors; a reviewer shown only a conclusion cannot.
Discuss this with the Zarketo team
Bring a workflow you want to improve and we'll walk through how connected context applies.
Book a Demo