Before an AI agent acts, decide what it must never do.

Map the workflow before adding AI

Begin with the trigger, information required, decision made, action taken and person accountable. If the existing process is unclear, AI can automate confusion faster. Select a narrow workflow with measurable value and reversible actions.

Treat external content as untrusted

Emails, uploaded documents, website text and user prompts can contain instructions that conflict with the system’s intended rules. OWASP identifies prompt injection as a leading risk for generative-AI applications. External content should be data to inspect—not authority that can silently redefine permissions.

• Least privilege
  Each agent receives only the tools and records required for its task.
• Human approval
  Payments, deletions and sensitive messages require confirmation.
• Data boundaries
  Secrets and personal data are filtered before model access.
• Auditability
  Inputs, decisions, actions and overrides are recorded.

Separate recommendation from execution

A safe first phase lets AI draft, classify or recommend while a person approves the outcome. Autonomous execution can be introduced later for low-risk, reversible tasks after accuracy and failure modes are understood.

Design failure as carefully as success

Define what happens when a provider is unavailable, data is incomplete, an integration times out or confidence is low. The system should stop safely, preserve context and route the task to a person instead of improvising.

Monitor business outcomes and security events

Track time saved and completion rate alongside rejected actions, approval overrides, unusual access and sensitive-data events. Automation is successful only when speed improves without weakening control.