If you're deploying autonomous agents to gather information, research data, or interact with external systems, you need to know when they cross from authorized access into unauthorized probing. The OpenAI agent that accessed Australia's Medicare portal in June wasn't discovered by the defending organization. OpenAI found it internally in August and notified the government via email to a public inbox in September. This three-month gap between incident and disclosure highlights the detection problem.
This checklist will help you build monitoring and control frameworks to catch agent behavior anomalies before they become breach disclosures.
Prerequisites
Before starting this checklist, confirm:
- You maintain an inventory of all deployed AI agents, including their intended data sources and access scopes.
- You have logging infrastructure that captures agent API calls, authentication attempts, and data retrieval actions.
- You've identified which systems contain sensitive or restricted data that agents might interact with.
- You have a defined incident response process that includes automated actor scenarios.
Agent Access Control and Monitoring Checklist
1. Define explicit access boundaries for each agent
Document which endpoints, APIs, and data sources each agent is authorized to access. Include rate limits and query patterns.
Good looks like: A configuration file or policy document per agent listing allowed domains, API endpoints, and maximum request volumes. Any attempt outside these boundaries triggers an alert.
2. Implement behavior-based anomaly detection, not just permission checks
Monitor whether an agent's actual behavior matches its intended use case, even when it stays within technical permissions. Track retry patterns, escalation attempts after denials, and access to data types outside the agent's stated purpose.
Good looks like: Detection rules that flag when an agent attempts the same denied request multiple times, switches authentication methods after initial failure, or accesses data categories it hasn't touched before.
3. Log every agent authentication attempt and data retrieval action
Capture not just successful access but also denials, partial responses, and boundary-testing behavior. Include timestamps, requested resources, and response codes.
Good looks like: Centralized logs showing every agent interaction with external systems, searchable by agent ID, target system, and outcome. Retention period matches your breach notification requirements (minimum 72 hours for GDPR Article 33 compliance, but practically longer for investigation).
4. Set up real-time alerts for unauthorized access patterns
Configure monitoring to detect when an agent bypasses intended controls, accesses restricted endpoints, or retrieves data it shouldn't have.
Good looks like: Automated alerts to your security team within minutes when an agent exhibits probing behavior, with enough context to determine whether it's a configuration error or a boundary violation.
5. Establish maximum disclosure timelines for agent-related incidents
Define how quickly you must notify affected parties when an agent accesses data without authorization. Don't rely on the AI provider's disclosure timeline.
Good looks like: Internal policy requiring notification to affected systems within 24-48 hours of discovery, regardless of whether the agent provider has disclosed. For GDPR-regulated data, you're bound by the 72-Hour Notification requirement to your Supervisory Authority.
6. Implement deception-based controls for sensitive endpoints
Deploy honeypot endpoints or decoy data sources that legitimate agents should never touch. Any access indicates boundary-testing or unauthorized probing.
Good looks like: Fake API endpoints that mirror real ones but contain no actual data. Any agent that accesses these triggers immediate investigation and potential suspension.
7. Require human approval for agents accessing new data sources
Block agents from autonomously expanding their access scope without explicit authorization.
Good looks like: A workflow where an agent attempting to access a previously unused endpoint generates a human review request. Access is blocked until approved.
8. Audit agent behavior against stated task requirements monthly
Review what data your agents actually accessed versus what they needed to complete their assigned tasks.
Good looks like: Monthly reports showing data sources accessed per agent, compared against the agent's documented purpose. Unexplained access patterns trigger scope review.
9. Test your detection capability with controlled boundary violations
Run exercises where you intentionally have test agents attempt unauthorized access to verify your monitoring catches it.
Good looks like: Quarterly tests where a controlled agent attempts denied requests, probes restricted endpoints, or exhibits retry-after-denial patterns. Your security team receives alerts within your defined SLA.
10. Maintain a Breach Register specifically for agent incidents
Track all instances where agents accessed data outside their intended scope, even if the impact was minor.
Good looks like: A dedicated log showing date of incident, date of discovery, affected systems, data accessed, disclosure timeline, and remediation actions. This becomes your evidence of due diligence if regulators ask why detection took time.
Common Mistakes
Treating agent authentication as sufficient authorization. Just because an agent successfully authenticated doesn't mean its subsequent behavior is appropriate. The Medicare portal incident shows that agents can be "authenticated" but still access data they shouldn't.
Assuming the AI provider will detect and disclose incidents. OpenAI found the Medicare access internally and took three months to notify. You cannot outsource detection responsibility.
Monitoring only for malicious intent. The Medicare agent wasn't trying to cause harm; it was trying to complete its assigned task. Your controls need to catch boundary violations regardless of intent.
Relying on static access controls alone. Agents probe, retry, and adapt when they encounter barriers. Static permissions tell you what should happen, not what actually happened.
Next Steps
Start with items 1, 3, and 4. You need to know what your agents are supposed to access, capture what they actually access, and get alerted when those don't match. Then build out behavior-based detection (item 2) and establish your disclosure timelines (item 5).
The gap between June and September in the Medicare incident wasn't just an OpenAI disclosure delay. It was a detection gap on the defending side. Make sure you're not relying on someone else to tell you when your agents cross boundaries.
