Skip to content
- Treat returned data as untrusted. Conversation text, notes, contact names and configuration labels can contain instructions aimed at an AI (prompt injection). Don’t let an agent with write scopes act on customer content without review.
- Least privilege. Give each agent its own short-lived, read-only credential. Enable
pii, message_content and internal_notes only if the task needs them.
- Keep secrets out of prompts and repositories. Put tokens in environment variables.
bearer_token_env_var, ${INSIDE_GATEWAY_TOKEN} and ${env:INSIDE_GATEWAY_TOKEN} keep the token itself out of config files, so those files are safe to commit.
- Keep a person in the loop for writes. Require approval for tools that aren’t read-only, or don’t grant write scopes.
- Revoke quickly. Rotating or revoking the credential in the console stops the agent on its next request.
- Disclose coverage. When an agent summarizes Gateway data, it should say which period, websites and coverage it used, and that unavailable measures are unknown rather than zero.
