Associated Risks, Controls, and Mitigation Strategies

Although AI agents and large language models (LLMs) offer significant benefits, their use can introduce additional risks to organizations. This topic is intended for both end users who will interact with AI agents and account administrators responsible for configuring NetSuite and managing this technology within the organization.

This topic outlines the key risks associated with the use of external AI agents and LLMs, security controls available in NetSuite, and suggest mitigation strategies. Note that this list may not be exhaustive or universally applicable, as both technology and associated risks continue to evolve.

• Risks

• Controls in NetSuite

• Mitigation Strategies

• Compliance Risks

Risks

The following are some of the key risks inherent to the use of LLMs:

• Prompt injection occurs when a malicious actor embeds hidden instructions within content that is processed by the LLM. This can cause the AI agent to perform unintended actions, such as executing unauthorized commands or leaking sensitive data. These hidden instructions can be placed in various sources, including PDF documents, web pages, or responses from third-party MCP servers or MCP tools added by end users.

• Hallucination refers to situations where the LLM generates information that appears accurate but is in fact incorrect or entirely fabricated.

• Tool poisoning occurs when a malicious or compromised MCP tool includes hidden instructions in its tool description, parameters, schema, or metadata. These instructions can influence an AI agent to perform actions that the user did not request, access unauthorized data, or disclose sensitive information.

• Rug pull or tool drift occurs when an MCP server or tool changes its description, schema, version, or behavior after it has been authorized. Consequently, an AI agent may run a modified version of a tool that differs from the one originally approved by the user.

• Malicious or compromised external AI agents, MCP clients, or MCP servers may misuse authorized access, mishandle authentication tokens, expose data outside NetSuite, or bypass intended customer workflows. Although NetSuite enforces controls within NetSuite, it cannot control the behavior of external AI agents, MCP clients, third-party MCP servers, or other non-NetSuite systems connected to the AI agent.

• Insufficient client-side policy enforcement may occur when an external MCP client or AI agent cannot correctly interpret or enforce capability or security policies provided by NetSuite. A client that ignores, weakens, or bypasses these policies may reduce the effectiveness of NetSuite security controls.

Both prompt injection and hallucination, tool poisoning, rug pull or tool drift, malicious or compromised external components, and insufficient client-side policy enforcement can result in:

• Unintended Actions - The AI agent may run powerful MCP tool functions - such as making payments or granting approvals - without the user's explicit intent.

• Corruption of Data - The AI agent may call MCP tools that delete or modify data in ways not intended by the user, potentially leading to data loss or integrity issues.

• Sensitive Information Disclosure - The AI agent may access sensitive data from NetSuite and disclose it to unauthorized parties.

Controls in NetSuite

Prompt injection and hallucination are LLM weaknesses and out of NetSuite control. Although NetSuite cannot eliminate these risks, it offers controls that account administrators and end users can use to reduce the impact of these risks.

• Account administrators have full control over which users are granted access to MCP. By default, no users have access. MCP permission must be explicitly granted to a role.

• MCP tools run with the same permissions as a NetSuite user who is using an external AI agent.

• MCP tools are never executed with Administrator or roles that have full permissions to access NetSuite features.

• MCP tools can only access a subset of SuiteScript API actions. Specifically:

  • "Run as role" is disabled for all tools.

  • Tools cannot invoke any SuiteScript scripts that run with elevated privileges.

  • Tools cannot invoke Suitelets.

  • Tools cannot perform HTTP requests to external destinations.

• All usage of MCP tools is logged, providing traceability and accountability for actions performed by AI agents.

• During the OAuth 2.0 authorization flow, the MCP server obtains explicit consent from each user for every AI agent.

• End users can scope MCP tools for an AI agent by specifying the MCP tools namespace.

Enabling External AI Agents in NetSuite

By default, the use of external AI agents in NetSuite is disabled. Enabling this feature requires coordinated actions from both account administrators and end users:

Steps for Account Administrators

• Assign MCP permissions - Grant MCP permissions to users who are authorized to use the feature.

• Install MCP tools - Install the MCP tools, which define the specific actions that external AI agents can perform.

Steps for End Users

• Configure an external AI agent.

• Authorize the external AI agent within your NetSuite account to act on your behalf.

Mitigation Strategies

Prompt injection and hallucination are known LLM weaknesses and out of NetSuite control. The following strategies can help to reduce the risks of unintended actions, data corruption, and sensitive information disclosure:

• Vendor and Tool Trustworthiness

• Access Management

• Scope Limitation

• User Awareness

• Technical Safeguard

Vendor and Tool Trustworthiness

• Use only trusted AI agents. Review their documentation or contact vendors to understand how they address prompt injection and hallucination risks.

• Connect to trusted MCP servers.

• Use only trusted MCP tools.

• Establish an approval process for AI agents, MCP clients, MCP servers, and MCP tools before allowing them to connect to NetSuite. Maintain an internal list of approved MCP servers and MCP tools, and do not allow users to connect arbitrary agents or MCP servers without administrative approval.

• Use MCP clients and AI agents that correctly interpret and enforce NetSuite capability and security policies, including CSP where applicable. The AI client should fail closed if a policy cannot be interpreted, validated, or enforced.

• Use MCP clients or AI agents that display the full tool name, description, input schema, parameters, capabilities, permissions, and expected action type before authorization or execution. Avoid AI clients that summarize or hide security-relevant tool information.

• For remote MCP servers and external AI agents, use secure authentication and authorization mechanisms. Use OAuth or OIDC where applicable. Require explicit user consent, short-lived tokens, and narrow authorization scopes. Validate tokens and revoke them when they are no longer needed.

Access Management

• Grant MCP permission only to users who require it.

• Do not assign MCP permission to users with high privileges. NetSuite does not allow Administrator roles or roles that have full permissions to access NetSuite features to use MCP.

• Create separate roles for different MCP tools instead of reusing broad operational roles. Separate roles according to business function and risk level whenever practical to further limit the scope of what an external AI agent can do.

• Periodically review users with MCP permission, assigned roles, installed MCP tools, enabled namespaces, authorized AI agents, and active consent grants. Remove access that is no longer required.

Scope Limitation

• Install and enable only the MCP tools that are necessary for your business needs.

• When trying new external AI agents, MCP servers, or MCP tools, start with a limited scope to minimize potential impact if something goes wrong.

• Prefer read-only or low-impact MCP tools during initial evaluation. Expand permissions only after reviewing the behavior, logs, and business need.

• Encourage end users to carefully select which MCP tools are enabled in their AI agents using MCP tools namespaces.

• Do not attempt to invoke MCP tools outside the namespaces authorized by the account administrator and user.

User Awareness

• Prefer external AI agents or MCP clients that require explicit user confirmation before executing high-impact actions. High-impact actions include creating, modifying, deleting, approving, paying, exporting large data sets, changing permissions, or accessing new sensitive resources. Confirmation prompts should clearly identify the action and the target resource. They should also identify the affected data and the MCP tool performing the action.

• Train end users on the risks of external AI agents and LLMs. Train them to recognize that documents, emails, web pages, third-party tool responses, and other retrieved content may contain hidden instructions intended to manipulate AI agents. End users must follow best practices for safe usage, verify sensitive actions and avoid connecting unapproved AI agents, MCP servers, or MCP tools.

Technical Safeguard

• Use MCP clients and servers that validate tool inputs and outputs against structured schemas and safely reject malformed or unexpected data. Before the validation, the AI client must treat tool inputs, tool outputs, retrieved content, documents, web pages, and user-provided data as untrusted.

• Run MCP servers in environments that provide sandboxing, restricted file system access, restricted network access, and explicit credential controls.

• Review the complete set of tools available to each AI agent. Avoid combining NetSuite MCP tools with tools that provide broad access to local file systems, browsers, email, messaging platforms, databases, or internal networks. Combine these tools only in trusted, isolated environments where the data flow is well understood.

• Regularly review NetSuite MCP logs together with logs from external AI agents and MCP servers to identify possible issues. These include unexpected tools, unusual activity, repeated failures, changes in tool behavior, or other anomalous activity.

• Document procedures for quickly disabling MCP access, removing MCP permissions, revoking AI agent consent, disabling specific MCP tools, or suspending access to third-party MCP servers when necessary.

Compliance Risks

As part of your use of MCP, become familiar with any limitations or restrictions established by the regulations where you operate. These regulations may affect your use of existing tools or new tools you create. Certain geographic locations also have specific requirements for use cases such as HR and financial processes.

General Notices