1
00:00:00,06 --> 00:00:03,02
- [Instructor] Now let's talk about security and privacy.

2
00:00:03,02 --> 00:00:05,07
This is about protecting your tools, data,

3
00:00:05,07 --> 00:00:10,02
and users from accidental leaks or malicious behavior.

4
00:00:10,02 --> 00:00:11,06
Why does security matter so much

5
00:00:11,06 --> 00:00:13,02
in the case of AI agents?

6
00:00:13,02 --> 00:00:16,08
Well, because agents don't just chat, they act.

7
00:00:16,08 --> 00:00:20,07
Each tool call touches a real system and real data.

8
00:00:20,07 --> 00:00:23,04
That's why security starts with designing limits

9
00:00:23,04 --> 00:00:26,08
on what the agent can do from day one.

10
00:00:26,08 --> 00:00:30,00
Good security begins with defense by design.

11
00:00:30,00 --> 00:00:32,03
That means keeping critical logic outside

12
00:00:32,03 --> 00:00:34,08
the model as much as possible.

13
00:00:34,08 --> 00:00:37,06
In our presales example, the agent controls

14
00:00:37,06 --> 00:00:39,08
the inputs to the quote calculation,

15
00:00:39,08 --> 00:00:42,06
but it can't generate the quote directly.

16
00:00:42,06 --> 00:00:44,03
We separate the sensitive logic.

17
00:00:44,03 --> 00:00:46,08
So a prompt injection can't force the agent

18
00:00:46,08 --> 00:00:49,03
to bypass business rules.

19
00:00:49,03 --> 00:00:50,08
Let's look at an example.

20
00:00:50,08 --> 00:00:54,05
In our pre-sales agent, we apply defense by design.

21
00:00:54,05 --> 00:00:56,06
The agent collects input variables,

22
00:00:56,06 --> 00:00:59,04
passes them to a secure internal workflow

23
00:00:59,04 --> 00:01:02,04
and receives back only the result.

24
00:01:02,04 --> 00:01:05,07
It never gets direct access to ordering the template

25
00:01:05,07 --> 00:01:09,00
as this workflow here is fully encapsulated,

26
00:01:09,00 --> 00:01:11,08
the LLM never really sees the process

27
00:01:11,08 --> 00:01:14,06
how a quote is being generated.

28
00:01:14,06 --> 00:01:16,00
But we still have to be careful

29
00:01:16,00 --> 00:01:18,04
because hackers might try to change how

30
00:01:18,04 --> 00:01:20,04
our agent handles data.

31
00:01:20,04 --> 00:01:23,01
This is what we call a prompt injection.

32
00:01:23,01 --> 00:01:26,02
It happens when someone hides malicious instructions

33
00:01:26,02 --> 00:01:28,02
inside user input, telling the model

34
00:01:28,02 --> 00:01:30,09
to reveal secrets, call the wrong tool.

35
00:01:30,09 --> 00:01:34,03
Or in our example, maybe provide a custom price

36
00:01:34,03 --> 00:01:37,08
to the quote workflow without using the calculator first.

37
00:01:37,08 --> 00:01:40,09
These attacks can make the agent skip critical steps

38
00:01:40,09 --> 00:01:42,07
or manipulate results,

39
00:01:42,07 --> 00:01:45,01
and they're one of the biggest real-world risks

40
00:01:45,01 --> 00:01:47,03
for agent systems.

41
00:01:47,03 --> 00:01:49,02
To defend against injections,

42
00:01:49,02 --> 00:01:50,08
put instructions and data only

43
00:01:50,08 --> 00:01:52,09
in the system prompt or use the limiters

44
00:01:52,09 --> 00:01:54,01
like triple back ticks

45
00:01:54,01 --> 00:01:58,02
to clearly separate dynamic inputs from instructions.

46
00:01:58,02 --> 00:02:02,05
Validate every parameter before executing them in a tool.

47
00:02:02,05 --> 00:02:05,01
And only allow the agent to call approved tools

48
00:02:05,01 --> 00:02:07,06
with expected argument types.

49
00:02:07,06 --> 00:02:10,02
Finally, treat your system prompts as code,

50
00:02:10,02 --> 00:02:12,09
static, and peer reviewed.

51
00:02:12,09 --> 00:02:15,06
When it comes to authenticating against other services,

52
00:02:15,06 --> 00:02:19,02
keep all credentials inside n8n's credential store.

53
00:02:19,02 --> 00:02:21,02
Never in the model context.

54
00:02:21,02 --> 00:02:24,07
Limit API tokens to the smallest required scope.

55
00:02:24,07 --> 00:02:27,00
And remember, the model should never see

56
00:02:27,00 --> 00:02:29,07
or handle raw API keys.

57
00:02:29,07 --> 00:02:31,06
Talking about protecting data,

58
00:02:31,06 --> 00:02:34,03
privacy is about respecting user data.

59
00:02:34,03 --> 00:02:36,04
Collect only what you need for a workflow,

60
00:02:36,04 --> 00:02:39,01
and if possible, mask or redact personal details

61
00:02:39,01 --> 00:02:40,09
in the locks and responses,

62
00:02:40,09 --> 00:02:42,07
and apply clear data retention rules.

63
00:02:42,07 --> 00:02:44,07
So sensitive information isn't stored

64
00:02:44,07 --> 00:02:46,09
longer than necessary.

65
00:02:46,09 --> 00:02:48,01
If you want two quick wins

66
00:02:48,01 --> 00:02:50,01
to make your AI agent more secure,

67
00:02:50,01 --> 00:02:53,01
then first, review which tools your agent

68
00:02:53,01 --> 00:02:56,02
can actually call and remove the ones it shouldn't.

69
00:02:56,02 --> 00:02:59,08
And second, add basic input validation to every tool.

70
00:02:59,08 --> 00:03:02,04
These two steps alone already close a lot

71
00:03:02,04 --> 00:03:05,00
of the most common security gaps.