Life Sciences Group Puts Its First Production AI Agents Through an Identity Review
A penetration test showed that a supplier document uploaded by anyone could steer an agent with authority to act.
The challenge
Seven agents had gone live drafting deviation reports, with read access across the quality management system and authority to raise items in a downstream workflow queue. They had been reviewed as a model deployment — provider, hosting, data retention — and not as a set of new accounts with standing permissions in a regulated system.
Our approach
We tested the deployment the way an attacker would. Instructions embedded in an uploaded supplier document reached the agent through retrieval and were acted on, and the retrieval index proved to span document classifications that no human user could have queried together. Remediation gave each agent its own identity, narrowed tool permissions to the specific actions its task required, rebuilt retrieval to respect source-system permissions, and added an audit trail recording the intent behind each action alongside the action itself.
The outcome
The injection path is now bounded: a successful attempt reaches a small set of low-consequence actions rather than the authority of a shared service account. Revocation has been rehearsed rather than assumed, and the group applies the same review to every agent before it goes live.