AI Agent Security Review Readiness Checklist

• Identify the system version, deployment, business owner and risk owner.
• Inventory agents, tools, identities, credentials and data flows.
• Identify high-impact actions and the requirements governing them.
• Record supplier dependencies and change notification arrangements.

• Define permitted actions, resource boundaries and approval conditions.
• Record where permissions and argument checks are enforced.
• Test denied and allowed actions in an authorised environment.
• Test approval expiry, altered requests, unavailable dependencies and rollback.
• State test counts, observed results and coverage exclusions.

• Index configuration, test and approval records against requirements.
• Assign each finding a remediation owner and acceptance test.
• Separate implemented, missing, failed and untested controls.
• Record unresolved risks and who can accept them.
• Set change triggers and the next review date.

This is a preparation checklist, not a certification or risk score.