HD Field Guide 03
Permission before automation
Reduce agentic AI risk with bounded actions, minimum access, approval points, audit trails and safe failure.
An AI assistant that can only suggest text has a different risk profile from an agent that can send email, modify files, approve transactions or call production systems. Capability must be matched by control.
Bound the mission
Define what the agent is allowed to achieve, which resources it may use and what conditions require it to stop. Broad goals such as “resolve the issue” can produce unpredictable action paths.
Use separate identities and environments for development, testing and production. Avoid shared administrative credentials.
Design human control into the workflow
Approval should occur at the point of consequence—not only when the agent is first enabled. Payments, account changes, public communication, deletion and security-control changes should have explicit review.
The reviewer needs enough context to make a real decision, including the proposed action, source information, uncertainty and expected effect.
Prepare for manipulation and failure
Agents may consume hostile instructions from webpages, documents, email or retrieved data. Treat these inputs as untrusted and isolate interpretation from privileged actions.
Set transaction limits, rate limits, rollback paths and a clear kill switch. Test what happens when tools fail, output is wrong or the model is manipulated.
Before you close the guide
- Defined mission and prohibited actions
- Dedicated minimum-privilege identity
- Human approval before consequential action
- Complete logs, limits, rollback and kill switch
Continue with primary guidance
This guide provides general educational information. Adapt it to your organisation’s policies, contracts, legal obligations and incident process. For an active incident, use trusted professional and official support channels.