Agent Security Hardening Harden the boundaries where an agent turns untrusted data into filesystem, network, memory, or tool actions. Produce concrete controls and tests for the framework being reviewed; a checklist without enforcement evidence is incomplete. Important - Treat model output, retrieved content, tool output, memory, and cross-agent messages as untrusted input. - Default external integrations to read-only and grant each write capability separately. - Validate at the action boundary even when an upstream prompt or schema already validated the value. - Fail closed before a side eff…