Give your AI agents a smaller blast radius.

Begin with the action, not the model

Before choosing a model, write down which actions an agent needs to perform and which systems those actions can affect. Reading a repository, modifying it, publishing a deployment and changing production data are different permissions. Treat them that way.

Build the boundary outside the prompt

A prompt can describe a policy. The system executing the tool must enforce it. Use narrow credentials, explicit target scopes and validation of tool arguments. Keep private credentials out of retrieved content and model-visible notes.

Make progress resumable and inspectable

1. Persist the task, sources, actions taken and open questions.
2. Use an explicit checkpoint before consequential actions.
3. Record observed results separately from model hypotheses.
4. Keep an operator-accessible stop and recovery path.

Measure the actual failure modes

Test whether untrusted input can induce actions beyond the task. Inspect permission boundaries, error recovery and whether a repeated job duplicates an action. A fluent answer is not evidence that these controls work.