AI Agent Guide
Knowledge Guides /How do you control permissions and unintended actions when connecting AI agents to business tools?
Last updated: · New Horizon Digital Outsourcing Team
Agents should receive only the minimum tool permissions needed for their tasks. Queries, generated recommendations, and writes should be managed separately. Deletions, external transmissions, and physical equipment actions require explicit approvals, scope, and auditing; a prompt saying not to make mistakes cannot be the only constraint.
Build a tool inventory first
- For each tool, specify what it can read and modify, where its targets are, and how failures are handled. Do not grant general database write access or arbitrary command execution by default. Provide narrower business interfaces for high-impact operations so parameters can be checked.
Put approval before execution
- Place policy checks between plan generation and actual execution. Action confirmations should show the target, impact, and key parameters instead of merely asking whether to continue. Approval of one action does not authorize all subsequent operations; recheck permissions when execution conditions change.
Prevent external content from steering operations
- Web pages, emails, and file contents are business data; they must not automatically become instructions to modify system rules. The tool layer should check identity and parameters and reject unauthorized requests. Record both model-proposed actions and actually authorized actions to support investigation of sources and responsibility.
Which exception paths should acceptance cover?
- Check unauthorized targets, duplicate submissions, rejected approvals, tool timeouts, and partial success. Deliver a permission matrix, audit records, and necessary recovery methods. Demonstrating one successful query does not establish that the entire tool-call chain can operate unattended.