Securing AI agents and data pipelines

AI agents and workflow orchestrators have something in common: to do useful work, they need credentials to many systems at once. That makes them some of the most valuable targets in a modern estate, and some of the least reviewed.

Security for these platforms has to cover two layers — the AI layer, where instructions and data mix in ways traditional applications never allowed, and the orchestration layer, which holds connections to databases, clouds and SaaS tools.

Threats specific to AI agents

The OWASP Top 10 for LLM Applications is a good map of the risks. The ones we see most often in enterprise projects are:

• Prompt injection: instructions hidden in emails, documents or web pages that the agent reads and then follows.
• Sensitive information disclosure: agents returning data the user should not see because retrieval ignores access rights.
• Excessive agency: tools with broader permissions than the task requires, so a manipulated agent can do real damage.
• Insecure output handling: model output passed straight into queries, code or other systems without validation.
• Unbounded consumption: runaway loops and abuse that drive up cost or exhaust quotas.

Controls that work

• Treat all retrieved content as untrusted input, and separate it clearly from system instructions.
• Enforce document-level permissions in retrieval, so agents only see what the requesting user is entitled to.
• Give each tool its own scoped credentials and require human approval for actions that change data, move money or contact customers.
• Validate and constrain model output before it reaches another system, using schemas and allow-lists.
• Set rate limits, token budgets and timeouts per agent and per user.
• Log prompts, tool calls and outputs to a tamper-evident store, and red-team agents before every major release.

Securing the orchestration layer

Orchestration platforms such as Apache Airflow deserve the same scrutiny as any production system that holds privileged credentials.

• Keep the platform supported and patched — open-source Airflow 2 no longer receives security fixes, so remaining on it is itself a risk.
• Store connections and secrets in a secrets backend such as AWS Secrets Manager, Google Secret Manager, Azure Key Vault or HashiCorp Vault, never in plain variables or DAG code.
• Use role-based access control so only the right people can trigger, edit or view sensitive workflows, and integrate with your identity provider.
• Pin and scan dependencies and provider packages, and build images in CI, to reduce supply-chain risk.
• Isolate workers by sensitivity, restrict network egress, and send audit logs to your SIEM.

Make security part of delivery

The most effective control is process: threat modelling during design, security checks in CI/CD, and regular reviews as agents gain new tools. At TrizenAI, security engineering is built into how we deliver AI and data platforms, not added at the end — because retrofitting controls onto an agent that is already in production is always harder than designing them in.