Securing an AI agent takes six controls: scoped identity, least-privilege tool permissions, PII tokenization, prompt-injection scanning, a kill switch, and an audit trail. Each one closes a distinct failure mode — identity so you know which agent did what, permissions so a compromised agent can’t call anything it wants, tokenization so a leak doesn’t look like the agent doing its job, injection scanning so a crafted input can’t hijack a tool call, a kill switch so you can stop an agent without waiting for it to cooperate, and an audit trail so there’s evidence when something goes wrong. This is what each one does, where it lives, and which plan it’s on.
Securing an AI agentmeans closing six distinct runtime failure modes — identity, tool access, data exposure, manipulated instructions, operator override, and evidence — with controls that sit outside the agent’s own reasoning. A system prompt telling an agent what not to do isn’t a control; it’s a request the model can be talked out of. Every item below is enforced at a layer the agent doesn’t get a vote on.
In the order most teams wire them in — identity and the decision layer first, since everything else depends on knowing which agent you’re looking at.
POST /v1/credentials/issue, verifiable against /.well-known/jwks.json) is the free floor — unlimited on every plan. Fuller identity — ownership verification, signed manifests declaring what an agent can do, and scoped delegations from a human account — is VeriSwarm Passport, on Pro and above. Plan: basic credentials free; Passport Pro+. How agent identity verification works.POST /v1/suite/guard/tool-permissions) let you define an allowlist per tool rather than trusting the agent’s own judgment about what it should call. Plan: Max (Guard).[VS:EMAIL:a1b2c3]) before it crosses a tool boundary, not after. VeriSwarm Guard runs this at POST /v1/suite/guard/pii/tokenize, backed by a Presidio-based NER detection engine, and Guard Proxy applies it transparently to every MCP tool call without agent code changes. Plan: Max (Guard). The three vectors this closes.POST /v1/suite/guard/scan) checks untrusted text before it reaches a step that can act on it, combining structural pattern detection with a DeBERTa ML classifier. Plan: Max (Guard). How the scan works.POST /v1/suite/guard/kill/{agent_id}) that blocks every subsequent decision check and credential issuance for that agent, regardless of what its own prompt says. It lives outside the agent’s reasoning entirely — the agent doesn’t get asked to stop, it’s denied at the policy layer the next time it tries to act. Plan: Max (Guard). How the kill switch actually works.It’s tempting to read a six-item checklist as six things you need to buy. That’s not how the tiers split. The decision layer underneath every control — VeriSwarm Gate — is free: full trust scoring, 5,000 allow/review/deny checks a day, unlimited event ingestion, and unlimited basic credential issuance. You can establish identity and start scoring agent behavior without a card on file. What’s gated is the enforcement layer — Guard’s tool permissions, tokenization, injection scanning, and kill switch, plus Vault’s queryable and exportable ledger — which is Max. Fuller Passport identity (verification, manifests, delegations) sits on Pro, in between. Don’t let a vendor imply the free tier is a stripped demo; for a large share of internal, low-blast-radius agents, identity plus the decision layer is enough on its own.
The six controls aren’t independent switches — they feed a single decision. Identity tells the policy engine which agent is asking. Trust scoring, driven by the event stream Guard and Gate both write to, tells it how that agent has been behaving. Tool permissions, PII tokenization, and injection scanning are the enforcement points where a specific request either proceeds or gets stopped. The kill switch is the override that beats all of it. The audit trail is what lets you reconstruct, after the fact, why a given request was allowed or denied. That decision — allow, review, or deny — is the trust layer sitting underneath all six controls. What a trust layer actually is.
Scoped identity (know which agent this is, and who's accountable for it), least-privilege tool permissions (restrict which tools it can call and under what conditions), PII tokenization (strip sensitive data before it crosses a tool boundary), prompt-injection scanning (catch manipulated instructions before they trigger a tool call), a kill switch (an operator override that lives outside the agent's own reasoning), and an audit trail (an immutable record of what the agent actually did). None of the six substitutes for another — an agent with perfect identity and no kill switch is still one bad prompt away from an incident.
The decision layer underneath all six is free: VeriSwarm Gate's trust scoring, allow/review/deny policy decisions (5,000 checks/day), unlimited event ingestion, and unlimited basic portable credential issuance (JWT identity tokens, JWKS-verifiable) cost nothing. The enforcement layer — Guard's tool permissions, PII tokenization, injection scanning, and kill switch, plus Vault's queryable and exportable audit ledger — is a Max-plan capability. Fuller identity verification with signed manifests and delegations (Passport) sits on Pro. You can wire in identity and start scoring behavior on the free tier; enforcement is where the paid plan starts doing work.
No. A system-prompt instruction is a request the model can be talked out of — that's exactly what prompt injection exploits. Every control on this list except identity operates outside the model's own reasoning: tool permissions are checked before a call executes, PII tokenization runs on the text regardless of what the agent intended, and the kill switch denies at the policy layer no matter what the agent's prompt says. The pattern across all four enforcement controls is the same — move the check to a layer the model can't argue with.
Identity and the decision layer (Gate) are the floor — deploy without them and you have no way to tell which agent did what, or to act on a pattern of bad behavior once you see it. The other four scale with what the agent can actually do. A read-only internal agent with no PII exposure has a thinner risk surface than one that calls a payments API and handles customer records — but the moment an agent can call an external tool or touch sensitive data, tool permissions and PII tokenization stop being optional. The kill switch and audit trail are cheap enough, in engineering terms, that there's rarely a good reason to skip them once Guard and Vault are already wired in.
Framework guardrails (LangChain callbacks, CrewAI's task validators, a custom try/except around a tool call) run inside the same process as the agent and depend on the agent's own code path executing correctly. The six controls here are external to that process — VeriSwarm sits between the agent and the tools/decisions it's trying to make, so a bug or a successful injection in the agent's own logic doesn't also disable the control checking it. That's the same reason a firewall isn't implemented as a setting inside the application it protects.
Each control closes a distinct failure mode, so skipping one leaves that specific mode open. Skip identity and you can't attribute an incident to a specific agent or revoke just that agent's access. Skip tool permissions and a compromised agent can call anything it has credentials for. Skip PII tokenization and a data leak looks like the agent doing its job. Skip injection scanning and a crafted input can trigger an unauthorized tool call before anyone reviews it. Skip the kill switch and there's no fast way to stop a misbehaving agent short of pulling its credentials. Skip the audit trail and you have no evidence of what happened, which matters as much for the postmortem as for the incident itself.
Gate’s trust scoring, decision checks, and basic credential issuance cost nothing. Add Guard’s enforcement controls and Vault’s exportable ledger when an agent’s blast radius warrants it.