Credentials
- Where does a user's credential physically rest, and who on your team can read it?
- If your primary database leaked tonight, is the credential usable by whoever has it?
- Can you revoke one user's access without rotating a secret shared by all of them?
- Does the credential value ever enter a process that also builds prompts?
- Is there a rotation schedule, and has it ever actually run?
The agent boundary
- Can the agent read the credential, or only the result of using it?
- If the agent summarises a tool response, could the secret appear in that summary?
- Does the credential appear in logs, traces, error messages or crash reports?
- What stops an instruction found on a browsed page from being treated as the user's?
Actions
- Which of your bindings are irreversible? List them explicitly.
- Is there a value ceiling per call, and a separate one per day?
- Which actions require a human to approve, and how are they asked?
- What is the maximum damage one compromised session can do before anyone notices?
Evidence
- Can you show, for any single action, which human authorised it and when?
- Is that record append-only, or can it be edited by whoever holds database access?
- How long do you keep it, and can you export it for someone else to check?
- Would you be comfortable showing the log to the user it concerns?
Eighteen questions. If you cannot answer four of them, that is where to start — whatever tool you use.
1muse