Guardrails: how to let an AI agent act safely

Risk 1: the wrong action

An agent that can send emails, update records or create transactions can also do those things by mistake. The answer is a tiered approval model:

• Low risk, such as drafting a reply or tagging a record: the agent acts and logs it.
• Medium risk, such as sending to a customer or updating an order: the agent acts within limits, and a person reviews samples.
• High risk, such as payments, price changes or legal commitments: the agent prepares the work, and a person approves it.

Risk 2: made-up answers

Language models can produce confident text that is not true. Agents should answer from your own documents and data, cite where an answer came from, and say “I don’t know” when the source is missing.

Before go-live, test the agent against real past cases with known correct answers, and keep running those tests every time the agent, its prompts or its model changes.

Risk 3: runaway cost

An agent stuck in a loop can call a model or an API thousands of times. Every task should have a budget, a maximum number of steps and a timeout. When a limit is hit, the agent stops and hands over to a person instead of trying again forever.

Risk 4: data exposure

Give each agent the least access its job needs: read-only where possible, and only the fields, folders and systems it must touch. Keep credentials out of prompts, mask personal data the task does not need, and choose model hosting that meets your data-residency rules.

Finally, keep a full audit trail. For every action you should be able to see what the agent saw, what it decided, what it did and who approved it.

A short checklist

• A written job description with clear “never do” rules.
• Approval steps matched to the risk of each action.
• Answers grounded in your data, with a test set run on every change.
• Budgets, step limits and timeouts on every task.
• Least-privilege access and a complete audit log.
• A named person who owns the agent and reviews its results.