Put boundaries around an AI agent’s actions

Begin with a bounded action

Define what the agent may read, draft, update and request. A tool that reads an order is different from one that cancels it. Keep consequential actions behind explicit business approval and make the user’s intended scope clear.

Expect an integration to fail

A network timeout does not tell you whether an action succeeded. Use durable workflow state and duplicate protection, and reconcile the destination before retrying. These engineering controls remain important even when the agent can reason about the task.

Preserve the chain of evidence

Record the input, permitted tool action, result and review decision at a level useful to the operating team. Minimise unnecessary personal information in logs. A clear action history supports both troubleshooting and accountability.

Evaluate completion, not conversation

The useful unit of measurement is a correctly completed business task. Track partial completion, unnecessary approvals, repeated actions, recovery and operating cost. A convincing explanation cannot compensate for an incorrect change to a core system.

Common questions