Bound an AI agent’s authority before it can act on business systems

Source fact: an agent expands the action surface

The joint government guidance Careful Adoption of Agentic AI Services describes agentic systems as combinations of models, tools, data, memory, identities, and orchestration that can pursue goals and take actions with less continuous human supervision. The guidance identifies risks including prompt injection, excessive permissions, unsafe tool use, poisoned or untrusted context, identity misuse, unexpected delegation, inadequate logging, and cascading effects across connected systems.

The agencies recommend beginning with low-risk uses and non-sensitive data, using distinct cryptographic identities, least privilege and just-in-time credentials, constraining tools and environments, monitoring behavior, and preserving meaningful human oversight. Designers and operators—not the agent itself—must decide which actions require human approval. High-impact actions should not become autonomous merely because a model expresses confidence.

Define an authority envelope

Document the agent’s exact objective, owner, users, data classes, memory, model and service dependencies, allowed tools, target systems, read and write permissions, transaction limits, network destinations, operating times, approval points, retention, and stop conditions. Include sub-agents and tool calls; a narrow chat interface can still have broad downstream authority. Separate development, testing, and production, and use synthetic or low-sensitivity data until controls are proven.

Give each production agent a unique non-human identity. Avoid shared user accounts, static credentials embedded in prompts or code, and permission inherited from a developer. Issue short-lived credentials for the specific task, bind them to approved services where possible, and remove access when the run ends. Treat instructions, retrieved documents, webpages, messages, and tool output as potentially hostile input.

DSE recommendation: require these controls before launch

1. Create an inventory entry for the agent, model, owner, version, tools, credentials, data sources, vendors, approvals, dependencies, and review date.
2. Allowlist tool functions and parameters. Enforce limits outside the model for recipients, destinations, amounts, records changed, execution time, and data returned.
3. Require a human to review the proposed action and relevant evidence before external messages, payments, access changes, destructive operations, code deployment, sensitive disclosure, or other high-impact steps.
4. Sandbox code and file operations, restrict outbound network access, scan retrieved content, and prevent one untrusted instruction from silently changing the agent’s governing policy.
5. Log prompts, relevant context, identity use, tool requests and results, approvals, policy denials, configuration versions, and final actions with sensitive-data controls.
6. Provide an immediate way to disable the identity, revoke credentials, stop runs, isolate outputs, preserve evidence, and roll back reversible changes.

Test prompt injection, confused-deputy behavior, forged approval, unavailable tools, excessive recursion, data leakage, partial failure, and emergency shutdown before production. Reassess after model, prompt, tool, permission, data, or workflow changes. Human review must be informed and practical; a rapid approval click with no visible action or evidence is not an effective control.