> For the complete documentation index, see [llms.txt](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/ai-agent-security.md). # AI Agent Security Discover and govern AI agents, models, and tools across AWS Bedrock, AWS Bedrock AgentCore, Google Cloud Vertex AI, Microsoft Copilot Studio, Microsoft 365 Copilot Agent Builder, Azure AI Foundry, Ope AI Agent Security extends Veza's authorization graph to include AI resources. It discovers AI Agents, AI Models, and AI Tools across AWS Bedrock, AWS Bedrock AgentCore, Google Cloud Vertex AI, Microsoft Copilot Studio, Microsoft 365 Copilot Agent Builder, Azure AI Foundry, OpenAI, Anthropic Claude, LiteLLM, Salesforce, ServiceNow, and Workday. From there, you can trace how agents access sensitive data through IAM roles and service principals, assign ownership for governance accountability, create access reviews, and alert on risky configurations. {% hint style="info" %} **Early Access**: AI Agent Security is an early access feature. Contact Veza support to enable it for your tenant. {% endhint %} ## Requirements * AI Agent Security feature flag enabled (contact Veza support) * At least one supported integration: * AWS (for Bedrock agents, models, and AgentCore runtimes) * Google Cloud (for Vertex AI agents) * Microsoft (for Copilot Studio bots, Microsoft 365 Copilot Agent Builder declarative agents, and Azure AI Foundry agents) * OpenAI (for OpenAI assistants, models, and vector stores) * Anthropic (for Claude managed agents, models, and tools) * LiteLLM (for gateway agents, model routes, and MCP servers) * Salesforce (for Agentforce agents) * ServiceNow (for AI Agent Studio agents and Now Assist assets) * Workday (for Agent System of Record agents, skills, and MCP tools) See [Configuration](/4yItIzMvkpAvMVFAamTf/features/ai-agent-security/configuration.md) for setup instructions per platform. ## What Veza Discovers Veza discovers three categories of AI resources: * **AI Agents**: Autonomous execution engines, including Bedrock agents, Bedrock AgentCore runtimes, Vertex AI Reasoning Engines, Copilot Studio bots, Microsoft 365 declarative agents, Azure AI Foundry agents, OpenAI assistants, Anthropic Claude managed agents, LiteLLM gateway agents, Agentforce bots, ServiceNow AI Agents, and Workday AI Agents * **AI Models**: Foundation models, custom models, and imported models used by agents * **AI Tools**: Knowledge bases, action groups, prompt templates, MCP servers, and other tools that extend agent capabilities See [Supported Entities](/4yItIzMvkpAvMVFAamTf/features/ai-agent-security/supported-entities.md) for the full list of entity types per platform, including entity properties and access relationship models. ## Navigating AI Agent Security AI Agent Security is organized into three views: * **Overview** — Aggregated counts and trends for agents, models, and credentials across connected platforms * **Agents** — Filterable list of all discovered agents. Filter by platform, ownership status, or creation date. Select an agent to view its linked models and access paths in the graph. * **Keys & Secrets** — AI-related credentials such as service account keys and API tokens. See [NHI Security](/4yItIzMvkpAvMVFAamTf/features/nhi.md) for credential management capabilities. ![AI Agent Security overview page.](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-a63dd953e5090c093433e0463cd1a2f15cacf905%2Fagent-security-overview.png?alt=media) ![AI Agent Security Agents view.](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-4faecf391110284480a4bf48eecfda60cd18a4eb%2Fagents-view.png?alt=media) ## Access Path Analysis Agents access resources by assuming IAM roles or service principals. Veza traces these multi-hop paths to show the agent's effective permissions across downstream resources. ```mermaid graph LR A[Bedrock Agent] -->|CAN_ASSUME_ROLE| B[IAM Role] B --> C[S3 Bucket] B --> D[RDS Database] style A fill:#ff9900,stroke:#232f3e,stroke-width:2px,color:#fff style B fill:#ff9900,stroke:#232f3e,stroke-width:2px,color:#fff style C fill:#569a31,stroke:#232f3e,stroke-width:2px,color:#fff style D fill:#569a31,stroke:#232f3e,stroke-width:2px,color:#fff ``` A Bedrock agent assumes an IAM role. Veza resolves the role's permissions and shows which downstream resources the agent can reach. This makes it possible to evaluate the full blast radius of a given agent, not just its immediate role assignment. See [Access paths and relationships](/4yItIzMvkpAvMVFAamTf/features/ai-agent-security/supported-entities.md#access-paths-and-relationships) in Supported Entities for common patterns and security considerations. ### Graph Investigation Preview In the **Agents** view, select an agent to open its details panel, then select the **Graph Investigation Preview** tab. The tab shows prebuilt relationship queries as selectable cards, each with a count of connected entities. Each card answers a common question, so you can assess the agent's access at a glance without building a query: * **Resources**: What resources can this agent access? * **Users**: What users have access to this agent? * **Models**: What models can this agent access? * **MCP Servers**: What MCP servers can this agent access? The **MCP Servers** card is displayed only when the agent has connected MCP servers. Selecting a card renders a read-only graph preview of that relationship, and **Open in Graph Builder** opens the query in [Graph Builder](/4yItIzMvkpAvMVFAamTf/features/search/graph.md) in a new tab. ![Agent graph investigation panel.](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-97f865d2ad0a5f27375cb061fe4c4d0f100f7de3%2Fagent-graph-investigation-preview.png?alt=media) ## Ownership Assign owners to AI Agents for governance accountability. Owners are notified when included in access reviews. Ownership can be assigned in bulk from the Agents view, or systematically using enrichment rules. **To assign ownership with enrichment rules:** 1. Create a saved query using [Query Builder](/4yItIzMvkpAvMVFAamTf/features/search/query-builder.md) that identifies the agents to enrich. 2. Go to **Integrations > Enrichment** and click **Add Enrichment Rule**. 3. Select **Entity Owner** as the enrichment type and choose the relevant AI Agent entity type (`BedrockAgent`, `BedrockAgentCoreRuntime`, `VertexAiReasoningEngine`, `MicrosoftCopilotStudioBot`, `OpenAIAssistant`, `AnthropicClaudeManagedAgentAgent`, `LiteLLMAgent`, `SalesforceBotDefinition`, `ServiceNowAIAgent`, or `WorkdayAIAgent`). 4. Select your saved query and specify owners from your integrated IdP or HRIS. 5. Save the rule and trigger a data source extraction. See [Enrichment Rules](/4yItIzMvkpAvMVFAamTf/integrations/configuration/enrichment.md) for full configuration details. ## Rules and Alerts Use [Saved Queries](/4yItIzMvkpAvMVFAamTf/features/search/saved-queries.md) to create rules that notify when AI security conditions change. Useful starting points: * Agents deployed without an assigned owner * Agents using models with `lifecycle_status = LEGACY` * Agents with write permissions to production databases Alerts can be delivered via email, Slack, webhooks, ServiceNow, or Jira. See [Rules and Alerts](/4yItIzMvkpAvMVFAamTf/features/insights/rules-and-alerts.md) for configuration. ## AI Agent Security and NHI Security AI Agent Security and [NHI Security](/4yItIzMvkpAvMVFAamTf/features/nhi.md) both surface non-human identities, but at different layers: | | NHI Security | AI Agent Security | | --------------- | --------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Discovers** | Service accounts, API keys, tokens, certificates | AI Agents, AI Models, knowledge bases, action groups | | **Platforms** | AWS, Azure, Google Cloud, and SaaS integrations | AWS Bedrock, AWS Bedrock AgentCore, Google Cloud Vertex AI, Copilot Studio, Azure AI Foundry, OpenAI, Anthropic Claude, LiteLLM, Salesforce, ServiceNow, Workday | | **Primary use** | Credential hygiene, key rotation, orphaned accounts | AI governance, model tracking, agent access analysis | The two work together. An agent discovered by AI Agent Security may assume an IAM role whose associated service account keys are tracked by NHI Security. ## Next Steps * [Supported Entities](/4yItIzMvkpAvMVFAamTf/features/ai-agent-security/supported-entities.md) — Entity types, properties, and access relationship models per platform * [Configuration](/4yItIzMvkpAvMVFAamTf/features/ai-agent-security/configuration.md) — Add required permissions to your cloud integrations * [Query Builder](/4yItIzMvkpAvMVFAamTf/features/search/query-builder.md) — Build and save queries for AI resources * [Access Reviews](/4yItIzMvkpAvMVFAamTf/features/access-reviews.md) — Create recurring reviews for AI Agent permissions * [Rules and Alerts](/4yItIzMvkpAvMVFAamTf/features/insights/rules-and-alerts.md) — Configure automated alerts for AI security events --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/ai-agent-security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.