When an AI agent goes wrong in production, the cause is rarely the model. It is usually the permissions. An agent that can read every table and call every endpoint will, sooner or later, do something nobody intended. This post is a checklist for scoping agent permissions before you ship.
1. Start from the task, not the tools
Write the agent's job in one sentence, then list the minimum operations it needs. For a support triage agent:
- Read: ticket text, customer plan, help-center articles
- Write: ticket tags, internal notes, assignee
- Never: refunds, account deletion, plan changes
If an operation is not on the list, the agent does not get it.
2. Separate read, draft and execute
Classify every action into three levels:
- Read: safe by default, still scoped to the data the task needs.
- Draft: the agent prepares an action (an email, a refund request) that a person approves.
- Execute: the agent acts directly. Reserve this for low-risk, reversible actions.
Most first agents should have plenty of read, some draft, and very little execute.
3. Scope data, not just endpoints
Giving access to a customers table is not the same as giving access to the customer in the current ticket. Where possible, pass the agent a scoped context (one customer, one order) instead of broad query access.
4. Put limits on value and volume
- Maximum monetary value per action
- Maximum number of actions per hour
- Hard stop and alert when either limit is hit
These limits catch both bugs and prompt-injection attempts.
5. Treat external text as untrusted
Emails, form submissions and web pages can contain instructions aimed at the agent. The agent's instructions should state clearly that content from customers is data to analyse, never commands to follow.
6. Log everything, readably
Each action should log: timestamp, input summary, tool called, parameters, result, and whether a person approved it. If a non-engineer cannot read the log, it will not get reviewed.
7. Make permissions easy to change
Permissions will change as you learn. If tightening a rule requires a deploy, it will not happen quickly enough. Whether you build with a framework or describe the agent's tools and limits to an AI Agent Builder, keep the permission definitions in one readable place that the whole team can review.
Pre-production checklist
- [ ] One-sentence job description
- [ ] Every action classified as read, draft or execute
- [ ] Data scoped to the current case
- [ ] Value and volume limits with alerts
- [ ] Customer content treated as untrusted input
- [ ] Human-readable action log
- [ ] Owner assigned for weekly review
Agents earn trust the same way new hires do: small responsibilities first, clear limits, and visible work.
Top comments (0)