Seven controls every AI agent needs before it touches production

An agent is a piece of automation that decides. That is what makes it useful and what makes it dangerous: a bug in a script fails loudly; a bug in an agent asks politely for something it should never have been able to ask for. Below are the seven controls we treat as a minimum before any agent reaches a production system.

1. Scoped identity

Every agent gets its own identity with the narrowest permissions that let it do its job, never a shared service account and never a human's credentials. If it reads invoices, it cannot write to the ledger.

2. Allow-listed tools

The model proposes; the runtime disposes. Tools are an explicit list with typed arguments, and anything outside it is rejected before the model sees a result.

3. Input provenance

Content the agent reads is data, not instructions. Emails, tickets and web pages are labelled by origin, and instructions found inside them are never executed without a human confirming.

4. Full action logging

Every tool call, argument and result is logged with the prompt that produced it. Not summaries. When something goes wrong, the log is the difference between a fix and a guess.

5. Budgets and rate limits

Tokens, tool calls and spend per run are capped. An agent in a loop should run out of budget, not out of your money.

6. A kill switch someone owns

One named person can stop the agent in under a minute, and everyone knows who. Rehearse it.

7. Review gates on irreversible actions

Payments, deletions, external messages and permission changes wait for a human. The agent drafts; a person approves. Speed on everything else is what makes this affordable.

The best agent programmes we have seen are boring in exactly the right places.

If you are planning an agent and want a second pair of eyes on the design, that review is a standard part of how we start every automation engagement.