SaaS teams are adding AI agents that read customer data and take actions in other systems. IBM's 2025 research found that only 37% of organisations had AI access controls in place, and the average breach in India cost INR 220 million. Meanwhile, the DPDP Rules notified in November 2025 and the CERT-In directions set clear duties on data and incidents. This checklist puts security and compliance for AI agents in one place.
Why agents change the risk
A chatbot that only answers questions can leak information. An agent that can send emails, update records or call APIs can also act on a malicious instruction. That is why OWASP lists Excessive Agency, LLM06, alongside Prompt Injection, LLM01, in its 2025 Top 10 for LLM applications. The more tools an agent holds, the more careful its permissions must be.
The OWASP LLM Top 10 in one table
The OWASP list is the most widely used starting point for AI application security reviews. Use it as a checklist for every agent feature.
| ID | Risk | First control |
|---|---|---|
| LLM01 | Prompt Injection | Treat retrieved content as data, never instructions |
| LLM02 | Sensitive Information Disclosure | Filter outputs, scope data by tenant |
| LLM03 | Supply Chain | Pin and review models, plugins and packages |
| LLM04 | Data and Model Poisoning | Control training and retrieval sources |
| LLM05 | Improper Output Handling | Validate output before it reaches code or users |
| LLM06 | Excessive Agency | Least privilege tools, human approval for actions |
| LLM07 | System Prompt Leakage | Keep secrets out of prompts |
| LLM08 | Vector and Embedding Weaknesses | Tenant isolation in vector stores |
| LLM09 | Misinformation | Ground answers in sources, show citations |
| LLM10 | Unbounded Consumption | Rate limits and spend caps |
Access controls for agents
Give each agent its own identity with the narrowest permissions it needs, separate per customer tenant. Require a person to approve any action that sends a message, moves money, deletes data or changes access. Log every tool call with the input, output and approver, so incidents can be reconstructed.
Never put API keys or credentials in prompts. Use a secrets manager and short-lived tokens issued at the time of the tool call.
DPDP duties for AI features
When an agent processes personal data, the SaaS company is either the Data Fiduciary for its own users or a Data Processor for its customers. Either way, purpose limits apply: data collected to provide support should not quietly feed a training set. Rights requests for access, correction and erasure must be addressed within ninety days, which includes data held in vector stores and logs.
Contracts with enterprise customers should state where AI processing happens, which sub-processors are used and how deletion requests flow through.
Logs and incident reporting
CERT-In's directions require logs of ICT systems to be kept for 180 days within India and specified incidents to be reported within six hours. For AI features, keep agent tool call logs with the rest of your security logs, and add prompt injection attempts and unexpected tool calls to your incident criteria.
- Central logging for app, agent, cloud and identity events.
- Alerts for unusual tool calls or data volumes.
- An incident runbook with the CERT-In report template.
- Breach notice templates for users and the Data Protection Board.
Testing before release
Test every agent with adversarial inputs: instructions hidden in documents, emails and web pages it reads, requests for other tenants' data, and attempts to trigger expensive loops. Repeat tests after any change to prompts, tools or models, because behaviour can shift.
A release checklist
Before shipping an agent feature, confirm least privilege tools, human approval for actions, tenant isolation, logging, rate limits, output validation and an updated privacy notice. XDQ Labs offers a free course on AI agent security and DPDP for SaaS teams, and its security team reviews agent features on systems clients authorise.
Frequently asked questions
What is the biggest security risk for AI agents?
Prompt injection, listed as LLM01 in the OWASP Top 10 for LLM applications 2025, combined with Excessive Agency, LLM06. An agent that reads untrusted content and holds broad permissions can be tricked into taking harmful actions.
Does the DPDP Act apply to AI features in SaaS products?
Yes, when they process personal data. The company must follow purpose limits, keep security safeguards, notify breaches and address access, correction and erasure requests within ninety days, including data in vector stores and logs.
How long must SaaS companies keep logs in India?
The CERT-In directions of 28 April 2022 require logs of ICT systems to be kept for 180 days within Indian jurisdiction, and specified cyber incidents to be reported within six hours.
Should AI agents act without human approval?
For actions that send messages, move money, delete data or change access, a person should approve. Approval steps limit the damage from prompt injection and model errors, and the approval log supports audits.
Sources
- India Records Highest Average Cost of a Data Breach, IBM India Newsroom, 2025
- OWASP Top 10 risks for LLM security 2025, Invicti, 2025
- 6 Hours To Report Cyber Incidents To CERT-In, Mondaq, 2022
- Digital Personal Data Protection Rules, 2025 (backgrounder), Press Information Bureau, 2025
- The OWASP Top 10 for LLMs 2025: How GenAI Risks Are Evolving, HackerOne, 2025
- India's Digital Personal Data Protection Act 2023 brought into force, Hogan Lovells, 2025
