An AI agent should not be allowed to do everything it can technically do. A useful system has a short list of jobs it can handle well and an even clearer list of actions it must never take on its own.

Do not let it invent authority

An agent should never treat a confident request as proof that a person has permission. It should not reveal another customer’s information, bypass a role boundary, or use a private source simply because the answer would be easier to find there.

Check identity and authorisation in the system that owns the data. Do not ask the model to decide whether a user is allowed to see a record.

Do not hide side effects inside helpful language

Sending a message, changing an account, issuing a refund, deleting a record, or confirming a booking is an action—not just a response. The user should be able to see what will happen before it happens, and higher-impact actions should require an approval or a separate verification step.

Keep read and write tools separate. If an action is irreversible, make that obvious in the interface and in the tool contract.

Do not make it the final safety net

An agent should not be the only check on fraud, compliance, a medical or legal decision, a security incident, or a dispute with a customer. It can gather context and prepare a recommendation, but a qualified person or controlled system must own the decision.

Do not confuse silence with success

If the agent cannot find a source, reach a tool, verify a detail, or understand the request, it should say so and route the work. A refusal is better than a polished answer that sends somebody in the wrong direction.

Write these boundaries down, test them with adversarial examples, and log attempts to cross them. Reliability is not the absence of mistakes; it is the ability to keep a mistake from becoming an uncontrolled action.