Before an AI Agent Can Act, Decide What It Must Never Touch

I tend to distrust a neat answer when the actual system is messy. A model that drafts an answer can be wrong. A model that deploys code or changes a payment record can make that mistake operational. The useful question is what somebody can demonstrate when the decision matters, not how persuasive the presentation was when everything was quiet.

Advice and action are different

A model that drafts an answer can be wrong. A model that deploys code or changes a payment record can make that mistake operational. (Autio et al., 2024). I want to know who owns the control, how it behaves when the normal process fails, and what evidence would change the decision. The answer has to come from the actual system rather than a slide describing the intended architecture.

Give the agent an identity

An agent running through a broad service account inherits its privileges, regardless of how carefully its prompt describes its intentions. (Rose et al., 2020). There is a difference between a policy and a capability. I would ask the team to demonstrate the important boundary, explain the exception path, and identify the person who can authorize the consequential action.

Put approval at the consequential boundary

I do not want approval prompts for every harmless action. I want them where an error becomes expensive, irreversible, or difficult to detect. (Temoshok et al., 2025). I want to know who owns the control, how it behaves when the normal process fails, and what evidence would change the decision. The answer has to come from the actual system rather than a slide describing the intended architecture.

The tool enforces the rule

Untrusted text may influence the model. The authorization decision must live in the tool and service, not in a sentence asking the model to behave. (Souppaya et al., 2022). There is a difference between a policy and a capability. I would ask the team to demonstrate the important boundary, explain the exception path, and identify the person who can authorize the consequential action.

Bound the surprise

The goal is not to promise that autonomy will never surprise us. It is to limit what a surprise can reach, change, and conceal. (Joint Task Force Transformation Initiative, 2012). I want to know who owns the control, how it behaves when the normal process fails, and what evidence would change the decision. The answer has to come from the actual system rather than a slide describing the intended architecture.

The decision I would make first

For an agent, I would inventory each tool call as a possible business action: read a document, modify a ticket, deploy a build, send an email, or transfer funds. Each action needs its own permission boundary and a record of what the agent requested and what the tool actually did.

I would also test what happens when retrieved material contains instructions intended for the agent rather than information intended for the user. The defense is not merely a stronger system prompt. It is a service that refuses unauthorized actions even when the model asks confidently.

If you are putting AI agents into production, I can help establish the boundaries that keep their authority proportionate to the task.