Learning Paths
AI Agents
Work through the proposal, authorization, execution and result loop of tool-using agents, and the controls that keep multi-step and cross-tool behavior within bounds.
- Audience
- Agent developers, platform engineers, security architects
- Approximate time
- About 2.5 to 3.5 hours
- Prerequisites
- Foundations path; Indirect Prompt Injection path recommended
Learning objectives
- Separate proposed, authorized, executed and observed action states
- Explain why tool availability or schema validity is not permission
- Use drift and chain findings as evidence, not authorization
- Place human approval correctly as exact-action-bound
Path sequence
01 Agent loop and attack surface
- 01 - LearnAI Agents and Tool Calling
How model proposals become actions and where authorization must decide.
- 02 - AttackAI Agent Prompt Injection
The attack reference for tool-using agents.
- 03 - AttackMCP Tool Metadata Injection
Optional deep dive: server-supplied tool metadata before any call.
- 04 - AttackTool Output Injection
Tool results are variable data, even when the tool call succeeded.
- 05 - Lab - Controlled simulationTool Output Injection (Lab)
Treat returned tool content as data in a controlled simulation.
02 Authorization and capability
- 06 - DefenseAgent Authorization
Decides deterministically whether a resolved action may execute, independent of what the model proposed.
- 07 - Lab - Controlled simulationAgent Authorization (Lab)
Decide resolved actions against policy in a controlled simulation.
- 08 - DefenseLeast Privilege
Limits which identities, tools and capabilities exist at all.
03 Multi-step behavior
- 09 - DefensePlan Drift Detection
Compares actions against an application-owned task baseline; findings narrow authority, never widen it.
- 10 - Lab - Controlled simulationPlan Drift Detection (Lab)
Separate benign adaptation from material drift in a controlled simulation.
- 11 - DefenseTool-Chain Analysis
Evaluates cumulative effects of action sequences that each look acceptable alone.
- 12 - Lab - Controlled simulationTool-Chain Analysis (Lab)
Reason about read-then-send sequences in a controlled simulation.
04 Approval and impact limits
- 13 - DefenseHuman-in-the-Loop
Informed approval bound to an exact action, not standing authority.
- 14 - Lab - Controlled simulationHuman Approval (Lab)
Separate approval validity from authorization in a controlled simulation.
- 15 - DefenseNetwork / Egress Restrictions
Controls which network paths exist, separately from action authorization.
Go deeper (optional)
- AttackMulti-Agent Prompt Injection
Delegation and inter-agent messages as additional boundaries.
- DefenseSandboxing / Containment
Caps the blast radius of influenced execution without making output trusted.
- ResearchAgentDojo
A dynamic benchmark environment for agent prompt injection.
- ResearchInjecAgent
A benchmark for indirect injection against tool-using agents.
- Incident - Read with its evidence classificationAWS-2025-019 - Amazon Q Developer and Kiro
A vendor advisory on coding agents; read with its stated scope.
Knowledge check
Think through each question, then open it to compare with the expected reasoning. There is no score.
The model produced a schema-valid call to an available tool. May it run?
Not on that basis. Schema validity checks shape and availability shows capability; authorization must still decide the resolved action.
Drift detection saw nothing unusual because telemetry was missing. Is the run within baseline?
No. Unobserved is its own state, neither failed nor safe. Missing evidence should be recorded as missing.
A user approved sending one report. Can the agent reuse that approval for a second send?
No. Approval is bound to the exact action shown and grants no standing authority.
After this path, you should be able to...
- Separate proposal, authorization, execution and result
- Explain why tool success or schema validity is not permission
- Use drift and chain findings as evidence only
- Combine least privilege, approval and egress limits into an agent design