An agentic AI system is deployed to manage a company's cloud infrastructure. A red team test shows that by sending a crafted request to the AI system, an attacker can cause it to deprovision production servers. Which of the following controls BEST addresses this vulnerability?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need least privilege and human-in-the-loop controls because they limit blast radius and stop automated deprovisioning. A deny-by-default model with explicit confirmation for destructive operations is the best fit.
Full Explanation
The deny-by-default permission model, where the AI agent has only the minimum permissions required for its task and destructive operations require explicit confirmation from an authorized human operator, is correct because the principle of least privilege applied to agentic AI systems limits the blast radius of successful attacks. Requiring explicit human confirmation for destructive operations such as deprovisioning or deletion adds a human-in-the-loop control for irreversible actions, preventing automated execution of attacker-induced commands. The read-only cloud API restriction would prevent the system from performing its intended infrastructure management role. The more capable AI model may be better at detecting attacks but does not provide a hard control boundary. Encrypting all communications between the AI agent and the cloud provider API protects communication confidentiality, not the integrity of commands an authenticated AI agent issues.