AI curriculum

Course outline for Agent Security

An agent may discover a tool or possess a credential without permission to commit an action. Build a delegated-action contract and enforce approval against exact parameters and object versions. Test escalation, stale approval, and changed scope in a local permission gate.

Technology: AI Security, Governance and Trust
Duration: 6 hours
Modules: 3 · 2 hours each
Level: Level 3

About Agent Security

Agent Security Course Objectives

Separate identity, authentication, and authorization decisions.
Define read, draft, and commit authority for an agent and worker.
Bind approval to action parameters, target, and object version.
Keep credentials out of model context and restrict execution capabilities.
Reject stale approval, changed parameters, and untrusted delegation requests.

Pre-requisites

Agent-loop and tool competence equivalent to Agentic AI Foundations.
Threat and trust-boundary competence equivalent to AI Security Foundations.
Basic authentication, authorization, APIs, and test-runner skills; federation and advanced isolation are not assumed.

Before this course

Complete the required courses or bring equivalent experience. Recommended courses add useful depth; they are not enrolment gates.

Required preparation

Recommended preparation

Understands agent tools and AI threats before enforcing delegated authority; authentication/authorization fundamentals remain entry skills.

Find your place in the learning map

Lab Setup

Computer with a supplied local mock API and permission-gate scaffold, test runner, and disposable restricted workspace.
Use dummy credentials, synthetic identities, versioned objects, and simulated workers; no real email or browser account is needed.
Supply denial and revocation fixtures; authenticated browser sessions and federation protocols are comparison topics, not required integrations.

Detailed Course Outline

Module 1: Identity is not authority

Agent identity: Assign distinct synthetic identities to agents and workers; separate who initiated an operation from what that identity may do.
Authentication: Verify the presented identity at the application boundary; distinguish valid credentials from permission to search, draft, send, or delete.
Authorization: Evaluate operation, target, parameters, and object version against policy; deny protected mutations independently of model instructions and authentication success.

Practical outcome: Specify synthetic identities and separate authentication from policy decisions for search, draft, send, and delete operations.

Module 2: Version-bound delegation

Delegation: Specify delegated actions with exact scope, version, expiry, and revocation; require renewed authority when parameters or the protected target change.
Least privilege: Separate read, draft, and commit capabilities; grant only task-required operations and prevent workers from expanding their own delegated scope.
Credential handling: Keep dummy credentials outside prompts and model-visible records; distinguish credential possession from delegated rights and account for revocation.

Practical outcome: Define a delegated-action contract with exact parameters, object version, expiry, and renewed-approval rules; keep dummy credentials outside prompts.

Module 3: Execution and worker boundaries

Tool permissions: Enforce operation-specific checks at the mock tool boundary; verify changed targets, stale approvals, and expired authority leave protected state unchanged.
Sandboxing: Limit accessible workspace and execution capabilities; distinguish isolation from authorization and identify effects that still need explicit permission checks.
Inter-agent trust: Treat worker instructions and discovery results as untrusted claims; verify delegated scope independently and reject escalation or reuse after revocation.

Practical outcome: Implement a local permission gate and limited workspace; reject untrusted worker instructions without mistaking read/write separation or isolation for authorization.

Practical exercise

Submit a delegated-action contract, mock permission gate, and before/after state test report.
Allow search and draft, then permit one exact approved commit; test unapproved send/delete and worker-requested escalation.
Deny every changed-target, changed-parameter, expired, or stale-version approval fixture without modifying protected state.
Verify the authorized commit occurs once, no dummy credential enters model-visible records, and a revoked worker cannot reuse the approval.

What you will produce

Enforce version-bound delegated authority in a mock agent permission gate.

How the work is checked

The allowed exact commit succeeds once; every supplied authority violation leaves protected state unchanged.
Approvals include parameters, target, object version, and expiry or revocation checks.
Model-visible records contain no dummy credentials and worker discovery grants no additional rights.

Six-hour local gate lab; federation, credential infrastructure, browser hardening, and production isolation require advanced implementation work.

When another approach is better

Do not delegate a mutation that cannot be constrained, verified, or escalated safely.
A sandbox or CQRS-style read/write split cannot substitute for authorization.
Simple fixed scripts may be preferable when dynamic tool selection adds unnecessary authority risk.

How we train

Ask about exercises, instructor feedback and the prior knowledge you need. Tool-specific courses marked provisional may become modules in a broader course.

Discuss your learning goals