Agent tool and skill vetting

What it does

It applies supplier and software assurance to the components agents assemble at run time, including the parts conventional scanning does not read: the natural-language descriptions and instructions that steer the agent. The owner of third-party risk sets the standard and security carries out the review, before first use and again at every change of version.

How to implement it

• Maintain an approved registry; agents load nothing from outside it.
• Review code, declared permissions and descriptions, and check that the three agree.
• Scan for hidden instructions as well as for malicious code.
• Pin versions and verify integrity on load.
• Assign each component an owner and a review date.
• Treat any update as a new submission.

Evidence it operates

Design: a vetting standard and a registry recording, for each component, its source, version, owner, permissions and approval. Operation: the components loaded by agents in production all appear in the registry at the approved version; a test attempt to load an unapproved component is blocked; review records exist for recent updates.

Where it fits

Operates before a component is first used and at every change. It feeds the AI bill of materials and relies on agent sandboxing and isolation to contain what review misses.

Limits

Review reduces the chance of a hostile component and does not remove it; instructions can be obfuscated and behaviour can depend on conditions not present in testing. Vetting is of little use if agents can still load components dynamically from elsewhere. It also depends on publishers behaving consistently between the version reviewed and the version delivered, which is why pinning and integrity checks are part of the control.