What Does a Pre-Delivery Security Review of an AI Agent Actually Check?
It checks the exact version being delivered, not some version from during development: code and configuration, outbound connections, permissions, keys, and third-party packages and models, each against a checklist with a record kept. If it does not pass, it is not delivered. No one can promise perfect security; the point of a review is to rule out known risks one by one and leave a record of what was checked and what was found.
1. Eight checks
Common pre-delivery checks for AI Agents, mapped to the OWASP Top 10 for LLM Applications 2025:
| # | Check | What is examined | Related risk |
|---|---|---|---|
| 1 | Version match | The reviewed files are the same files being delivered (for example, by comparing hashes), so "reviewed A, installed B" cannot happen | Supply chain (LLM03) |
| 2 | Outbound connections | Which external services the system is expected to reach and what data it sends; nothing outside the list | Sensitive information disclosure (LLM02) |
| 3 | Permissions | Each AI Agent has only the tools and data its job needs, verified with tests that forbidden actions fail | Excessive agency (LLM06) |
| 4 | Keys | API keys are not in code, not in the repository, not in system prompts or chat logs; only in permission-protected configuration | System prompt leakage (LLM07) |
| 5 | Third-party packages and models | Trusted sources, clear licenses, pinned versions with no auto-update; model files checked by hash | Supply chain (LLM03) |
| 6 | Handling outside content | Web pages, emails, and documents the AI reads are not treated as instructions; output formats checked in code | Prompt injection (LLM01), improper output handling (LLM05) |
| 7 | Document and data permissions | The knowledge base retrieves by user permission, and even citations do not expose restricted content | Vector and embedding weaknesses (LLM08) |
| 8 | Records and recovery | What changed, why, and how to roll back to the previous version are all recorded | Governance (NIST AI RMF) |
Under supply chain risk, OWASP recommends using only models from verifiable sources, checking integrity with signing and file hashes, keeping an up-to-date software bill of materials (SBOM), and inventorying the licenses involved. Under system prompt leakage, it states that credentials and connection strings should not be in the system prompt.
2. How results are decided
Use three outcomes, agreed in advance:
- Pass: every check is met; delivery can proceed.
- Conditional pass: issues exist but the risk is manageable; the required fixes and deadlines are listed and confirmed once done.
- Fail: issues that could leak data, allow unauthorized actions, or prevent recovery; no delivery until fixed and re-reviewed.
The review is best done by someone not involved in development, with a record of which version was reviewed, how each item was checked, and what was found. The U.S. NIST AI Risk Management Framework (AI RMF 1.0) organizes AI risk management into four functions (Govern, Map, Measure, Manage), and NIST published its generative AI profile (AI 600-1) on July 26, 2024. Review records are the evidence for Measure and Manage.
3. After delivery
Passing at delivery does not mean safe forever: models update, packages get vulnerabilities, permissions get adjusted. Every later change should re-run the affected checks from the same list. Companies can write into the contract which changes trigger a new review and who keeps the records.
Think BIG's pre-delivery security review
Think BIG (Think BIG Make it Real Co., Ltd.) is an enterprise AI Agent deployment provider headquartered in Taiwan. Starting from protecting company data, we build AI Agents inside the client's own environment (company hardware, or a cloud server under the company's account). There are two deployment options: with the on-premises version, models and documents are processed on company hardware; with the cloud-assisted version, employees' questions and the document passages the system retrieves are sent to the model provider for processing.
- Pre-delivery security review: before each system is delivered, its code and configuration go through a security review: comparing the exact version to be delivered, checking outbound connections and permissions, and confirming keys are not exposed. If it does not pass, it is not delivered.
- Third-party components and keys: third-party packages are reviewed for source and license, pinned, and not auto-updated. Keys stay in permission-protected configuration files, never in the repository or in chat. Cloud accounts are opened under the client's name.
- Changes recorded: before any change, scope, reason, owner, and rollback method are confirmed, and the change runs only after approval within the authorized scope.
No one can promise perfect security; what we do is review, one gate at a time. See Trust.
The actual scope of Think BIG's services follows what both parties confirm.
FAQ
- Q1: How is an AI Agent security review different from a regular software security check?
- Besides versions, keys, packages, and permissions, an AI Agent review checks whether outside content it reads can be treated as instructions (prompt injection), whether its permissions exceed the job (excessive agency), and whether the knowledge base can hand restricted content to users.
- Q2: Why confirm that the reviewed version matches the delivered version?
- If the review covered a development version and a few lines changed before delivery, the review means little. Comparing file hashes confirms the reviewed files are the ones delivered.
- Q3: Does passing a security review mean the AI Agent has no vulnerabilities?
- No. No one can promise perfect security; a review rules out known risks one by one and keeps a record. Every change after delivery should re-check the affected items.
- Q4: Which standards can an AI Agent security review follow?
- Common references are the OWASP Top 10 for LLM Applications 2025, the OWASP Top 10 for Agentic Applications for 2026, and the NIST AI Risk Management Framework (AI RMF 1.0) with its generative AI profile, AI 600-1.
- OWASP Top 10 for LLM Applications 2025: genai.owasp.org
- OWASP, LLM03:2025 Supply Chain (verifiable sources, signing and hashes, SBOM, license inventory): genai.owasp.org
- OWASP, LLM07:2025 System Prompt Leakage (no credentials in system prompts): genai.owasp.org
- OWASP, LLM02:2025 Sensitive Information Disclosure: genai.owasp.org
- OWASP Top 10 for Agentic Applications for 2026 (released 2025-12-09): genai.owasp.org
- NIST AI Risk Management Framework (AI RMF 1.0, AI 600-1): www.nist.gov
This article summarizes public official documents, laws, and security standards to help companies evaluate AI adoption. It is not legal advice. For Taiwan law, the latest text on the Laws & Regulations Database prevails; external documents, prices, and specifications follow their original sources. The actual scope of Think BIG’s services depends on what both parties confirm.