Bot Lock Field Kit Playbook

AgentHive Inc. — Operator-dense, defense-only guidance for securing AI agents that use tools, MCP servers, and credentials.
Product: Bot Lock · Companion: Field Kit ($49 one-time) · Version: 2.1
Audience: Platform engineers, security operators, SRE/on-call, and agent owners who run production or staging agent systems they are authorized to control.

This playbook designs, reviews, and verifies agent control planes. It does not provide exploit PoCs, attack payloads, bypass recipes, or unauthorized testing procedures. Authorized self-assessment themes align with Bot Lock Check. Red-team exploit reproduction is out of scope.

Table of contents

1. Why this exists
2. Core principles
3. Threat model checklist
4. Weighted control catalog
5. Policy how-to (Field Kit YAML) — includes OAuth/token and exfil/I/O how-tos
6. Kill-switch runbook
7. Authorized verification playbook — includes drills V1–V10
8. Anti-patterns
9. 30-day adoption / rollout plan
10. Sample audit event shapes
11. Incident vignettes
12. Honest limits
13. Product map and file map
14. Appendices — glossary, operator card, implementation notes, tabletops, Check mapping, FAQ, weekly audit ritual, on-call card, procurement / honesty FAQ

1. Why this exists

AI agents that read untrusted content and call tools turn text into actions. That is the product value and the security problem in the same sentence. A support agent that can open tickets, draft replies, and look up customer records is useful until a poisoned email, a malicious PDF comment, or a compromised MCP plugin rewrites its intent and those same tools become the blast radius.

Operators are already shipping agents with:

• Tool access — email, calendars, browsers, shells, databases, ticketing, CI/CD, payment APIs, cloud control planes.
• MCP and plugin ecosystems — third-party servers that extend capability without going through traditional app-sec review gates.
• Credentials and non-human identities (NHI) — service accounts, OAuth tokens, API keys, and delegated user scopes that persist longer than any single chat turn.
• Multi-hop context — RAG corpora, long-term memory, agent-to-agent messages, and shared session state where untrusted text can persist.

Industry educational sources (weighted themes from English operator-facing material, Mar–Sep 2026) repeatedly surface the same failure modes. Bot Lock Check and this Field Kit playbook weight controls by how often those themes appear in that research set:

Who this playbook is for

• Agent owners who decide which tools and credentials an agent may use for a business workflow.
• Platform / runtime operators who load policy YAML, wire audit sinks, and run kill-switch drills.
• Security engineers who threat-model entrances, review allowlists, and score posture with Bot Lock Check.
• On-call responders who need a halt path that fails closed without improvising under pressure.