An AI agent security buyer's checklist: 12 questions to ask before a pilot

Published 2026-09-23 · NextGen Identity Security desk · 4 min read

AI agent security products are young, and their public pages vary widely in how much they say. A checklist keeps a buying process fair: every vendor answers the same questions, in writing, before a pilot starts. The twelve below follow the six criteria we use to score the category.

Credentials

1. Does the agent ever hold a long-lived credential? The strongest answer is no: the product issues short-lived, scoped credentials per task, or executes calls with credentials the agent never sees. NewCore and Aembit both state this on their public pages.

2. How long do issued credentials last, and can they be limited to one resource? The MCP authorization specification requires clients to name the specific MCP server a token is for, and says authorization servers should issue short-lived access tokens. Ask whether the product follows both.

Checks at the moment of action

3. Is each tool call or operation checked against policy when it runs, or only at sign-in? Products differ here more than anywhere. Silverfort's gateway approves or blocks each tool call before it runs; Microsoft applies Conditional Access to agents at sign-in and token issuance.

4. What can a policy see? At minimum: the tool, the operation, the data, the person the agent acts for, and the context. A policy that only sees the agent's name cannot tell reading from deleting.

5. Is the check available today? Okta's Agent Gateway was announced on 22 September 2026 as planned for Q3 2026 (https://www.okta.com/newsroom/press-releases/ai-innovations-oktane-2026/). Ask each vendor for the general availability date of every component you plan to rely on.

People

6. Is every agent tied to a named person or team? Microsoft assigns owners and sponsors to agent identities, Silverfort binds each agent to a human identity, and NewCore ties every action to the accountable human or team.

7. Can a risky action wait for human approval? Ask which actions can be routed to a person, how that person is chosen and what happens if nobody answers. On the pages we reviewed, NewCore describes routing calls for human approval by policy; the other products scored on the AI agent page do not describe an approval step.

Agents you do not know about

8. Can the product find agents that were never registered? Okta surfaces unsanctioned agents and registers them in a central directory; Silverfort discovers agents through read-only APIs across Entra ID, Okta, AWS, Azure and GCP. Ask which platforms are covered and how often discovery runs.

Evidence

9. What does one log record contain? Look for the agent, the person, the tool and operation, the policy and the decision. Aembit logs each MCP request with agent identity, user identity, target server and policy decision; Docker streams one structured event per evaluation to a SIEM.

10. Can you stop one agent without stopping the person? NewCore describes terminating a session, an agent or a human path without disabling the whole account. Okta listed expanded Kill Switch capabilities for Q4 2026.

Fit and price

11. Which agents, tools and protocols are supported now? Ask for the list. Aembit names Claude, Microsoft Copilot Studio and Gemini CLI; Okta publishes the Cross App Access protocol; NewCore publishes an MCP gateway and an OAuth-based Enterprise Managed Authorization flow.

12. What does it cost, and on what basis? Aembit publishes a free-forever tier. Okta for AI Agents is an add-on to Workforce Identity plans with no published add-on price. Microsoft says extended agent security features need Microsoft Agent 365. NewCore and Silverfort do not publish pricing.

How to use the answers

Score each vendor's written answers on the same six criteria, weighted for what matters to you. The calculator does this with our scores as a starting point; replace them with your own once the answers are in.