Start with the data
Classify what the system can access:- public information;
- internal business information;
- personal data;
- commercially sensitive material;
- credentials or secrets;
- regulated or high-impact information.
Review tool permissions
For an agent or automated workflow, list every action it can perform. Ask:- Can it read only, or write?
- Can it send messages externally?
- Can it create, modify or delete records?
- Can it initiate payments or commitments?
- Can it access multiple clients or workspaces?
- Can permissions be scoped to the minimum needed?
Separate reversible from irreversible actions
A draft that a person reviews is different from an autonomous action that changes a production system. Increase controls as reversibility decreases.Consider prompt injection and untrusted content
If the system reads email, websites, uploaded files or third-party content, treat that content as potentially untrusted. Do not allow external text to silently override system rules or grant new permissions.Use approval boundaries
Examples:- draft but do not send;
- recommend but do not approve;
- create a proposed CRM change but require confirmation;
- allow low-risk routine actions only within explicit thresholds.
Log important actions
Where the use case warrants it, retain enough evidence to understand:- what action occurred;
- which data or instruction caused it;
- who approved it;
- whether the action was changed or reversed.