An AI agent is a language model that can act: it calls tools, reads files, sends requests and remembers what it saw. The moment output becomes action, the security questions change. This course is about the boundaries that keep an agent’s actions within what you intended, built and tested one by one on a local bench you can watch step by step. You start by building that bench: Ollama in a container bound to localhost, a small tool-calling model chosen for size, speed and licence, and a minimal agent loop in Python that logs every step. From the first tool call you see how the model chooses arguments, including invented ones, and why validation has to start at the tool boundary.
Next you read the Model Context Protocol from the defender’s seat. You write your own MCP server with the Python SDK, list exactly what the model will see, learn why tool annotations are hints rather than controls, and validate both tool inputs and structured results. Least privilege follows: an open-ended shell tool is replaced by narrow functions, file paths are confined correctly, and read and write access are split across separate servers.
Every tool call then passes through one decision point. You run OPA, write Rego policies with argument-level rules for paths, hosts and row limits, wire the agent loop to ask before every call, and test the policies before they ship. Tools run in hardened containers with a read-only filesystem, all capabilities dropped, no network by default and resource limits, and agent-written code runs in throwaway containers. Stronger isolation options are explained conceptually.
