Guardrails in Layers: Securing AI Agents in Practice
An AI agent with tools is no longer a chatbot: it reads e-mails, tickets and web pages written by strangers, and it can act. That makes prompt injection a real security problem, and no prompt or filter solves it alone. In this course you build defence in depth: seven layers, from treating untrusted content as data to least-privilege tools, a sandbox, output validation, human approval, budgets and an injection test suite. Every layer comes with a configuration you write and an attack you run against it.
New
Offered by ITwithDom- Last updated November 2026
- Language: English
- 4 h 30
- E-learning
What you'll learn
- Explain direct and indirect prompt injection, and why a filter alone can't stop it
- Remove one of the « three ingredients » (private data, untrusted content, a way out) from an agent's design
- Lock down an agent's tools with least privilege, ask rules and scoped credentials
- Run an agent in a sandbox with a network allowlist, and know what the sandbox doesn't cover
- Validate model output before it reaches a browser, a database or a shell, and build an injection regression suite
Practical information
- Format
- E-learning
- Location
- Online
- Schedule
- Self-paced: about 2 h 07 of lessons, plus 2–3 h for the final project. One layer per sitting works well.
Course content
8 lessons, 2 h 07 in total
- Why agents need layers11 min
- Layers 1–2: untrusted content is data14 min
- Layer 3: tools and least privilege15 min
- Layer 4: the sandbox14 min
- Layer 5: output handling12 min
- Layer 6: human approval and limits12 min
- Layer 7: monitoring and injection tests25 min
- Final project: harden a support agent24 min
Description
A practical course on securing AI agents that read untrusted content and use tools: prompt injection, least privilege, sandboxing, output handling, human approval, budgets, monitoring and injection regression tests. Hands-on with Claude Code's permission rules, sandbox and hooks.
Key information
- Learning objectives
- Threat-model an agent: assets, untrusted inputs and exits
- Configure permission rules, the sandbox and blocking hooks for Claude Code
- Design output handling and human-approval points for high-impact actions
- Write and run prompt-injection test cases as a regression gate
- Who it is for
- Developers, platform and security engineers who build or operate AI agents with tool access, and tech leads who have to sign off on them.
- Prerequisites
- Basic command line. Required for exercises 2–5: Claude Code 2.1.295 or later (any paid Claude plan or API credits; the exercises use a few cents of usage) on macOS, Linux or WSL2, plus Node.js 22+ and jq. Exercise 3 on Linux or WSL2 also needs bubblewrap and socat (sudo apt install bubblewrap socat). No security background required.
- Duration
- 4 h 30
- Price
- Free
- Teaching format
- E-learning
- Access conditions and lead time
- Free. Create a learner account on the course page and start immediately. Immediate access after enrolment.
- Teaching methods
- Short explanations with diagrams and an animated walkthrough, attacks you run yourself against your own configuration, and a final hardening project. Starter kit with sample attacks included.
- Assessment
- Short checkpoint quiz on every page (one mistake allowed), final exam at 70 %, Four hands-on exercises with a rubric, Final project (threat model + hardened config + test evidence) with a reference solution
- Accessibility for people with disabilities
- Self-paced, no time limit. Diagrams have text descriptions, the animation has captions, all code is text.
- Contact
- Dominik Heinrich (ITwithDom)
The training provider
ITwithDomSee the profile and all its courses More courses from ITwithDom
See all
Guardrails in Layers: Securing AI Agents in Practice
Free