AI agents

Keep actions behind permissions

An agent can interpret a request and propose using a tool. That does not mean a model should have unrestricted access to the underlying system. Expose a narrow set of capabilities, validate arguments, and check the user’s authorization before consequential operations. Read-only lookup, draft creation, and irreversible changes need different permissions and review paths.

Keep credentials, policy checks, and side effects in application code. Treat tool responses as potentially incomplete or malformed: normalize them, limit their size, and pass forward only necessary fields. For impactful operations, ask a person to approve a clear summary before execution.

Set limits and safe retries

Define a maximum number of tool calls, an overall time budget, and stopping conditions for success, failure, or escalation. Limit input and output size. When a limit is reached, return a useful partial result and explain what remains unresolved. Focused tools with clear inputs and outputs are easier to validate than a broad capability.

Validate identifiers against the caller’s scope instead of trusting model-supplied values. Give repeatable operations an idempotency strategy. For other actions, check for duplicate submissions and reconcile uncertain state before trying again.

Make the sequence inspectable

Record the key stages: request received, policy applied, model result parsed, tool selected, authorization checked, tool outcome, and final response. Include timing and normalized outcomes, not secrets or full sensitive payloads. Make retries visible and set limits. A model-call retry and a state-changing tool retry have different risks.

Escalate ambiguous requests, missing data, failed policy checks, and actions outside the agent’s authority. Give the person a concise summary, prior steps, and the specific decision needed.