The agent is not the authority
The model may propose a structured plan. Independent services determine whether the action is valid, authorized, within budget, approved, executable, verified, and reversible. Business authority remains with the client’s process owner, identity system, policy engine, and human approvers.
Non-negotiable controls
Deny by default
Actions not explicitly allowed are blocked.
Least privilege
Each tool receives only the operation, records, fields, destinations, and time needed.
Separation of planning and execution
The planner does not possess production credentials.
Bounded agency
Steps, time, cost, records, recipients, transactions, retries, and risk tier are capped.
Approval before consequence
External, privileged, financial, rights-affecting, or hard-to-reverse actions require a qualified human.
Verified and reversible execution
Success is confirmed from authoritative state; failure triggers compensation, rollback, or safe stop.
Suitable starting patterns
- Intake and triage
- Document extraction with human exceptions
- Approved-repository research and evidence packets
- Internal draft preparation
- Reconciliation and staged corrective actions
- CRM or case updates with field-level allowlists
- Compliance evidence collection
- Low-risk IT service support
- Accounts-payable matching without payment release
Automatic no-go patterns
- Open-ended “run the business” objectives
- Shared administrator credentials
- Autonomous payment release or bank-detail change
- Final high-impact decisions about people
- Unrestricted shell, browser, database, cloud, or identity administration
- Irreversible deletion without tested recovery
- Self-created tools, permissions, sub-agents, or policy changes
