Give the agent its own, limited identity
An agent should never borrow an administrator's login. It needs its own credentials with access to exactly the tools and records its task requires, and nothing more. If its job is to read orders and issue small refunds, it should not be able to delete customers.
Check actions, not just answers
Every tool call the agent makes can be validated before it runs: is the amount within the limit, is the customer the right one, is this action allowed at this time? Rules written in code are more dependable than instructions written in a prompt.
Keep a person in the loop where it counts
- Payments, refunds and credits above a set amount
- Deleting or overwriting records
- Messages sent on behalf of a named person
- Anything the agent is unsure about
Respect data permissions
When an agent searches documents or records, it should apply the same permissions as the person it is acting for. A sales rep's assistant should not surface HR files just because they sit in the same storage.
Defend against prompt injection
Emails, web pages and documents an agent reads may contain text that tries to give it new instructions. Agents should treat that content as data, never as commands, and sensitive actions should depend on checks the content cannot change.
Log, evaluate, improve
Every step should leave a trace: what the agent saw, which tools it used, what it decided and who approved it. Those traces feed a test set that is run on every change, so quality is measured rather than assumed.