How to keep an AI agent under control.

Limit the blast radius

The most dependable control is reducing what the agent can reach. Give it a scoped identity, the minimum necessary records and a small set of explicit actions. Read access and write access should be separated; a tool that can draft a transaction does not automatically need authority to execute it.

Boundaries also apply to time, money and volume. A workflow can cap the number of records changed, require approval above a value or stop after repeated failures. These limits protect the business even when the model misunderstands an instruction.

Treat external content as untrusted

Agents often read email, web pages and uploaded documents. Those sources may contain incorrect information or instructions designed to redirect the system. External text should be treated as data, not authority, and it should never silently override the agent’s governing rules.

• Separate system instructions from retrieved or user-supplied content
• Allowlist tools and validate every structured argument before execution
• Keep credentials outside prompts and model-visible logs
• Require confirmation when an instruction changes scope or recipient
• Test with malicious, conflicting and incomplete examples before launch

Human approval should be specific

A person clicking approve on every step creates fatigue, not control. Approval is most useful at a consequential boundary: sending an external message, changing a financial record, releasing sensitive information or accepting an uncertain exception.

The review screen should show the proposed action, supporting evidence, uncertainty and what will change. After execution, an audit trail should connect the request, decision, tool call and result without retaining more sensitive data than necessary. Singapore organisations should also assess their own data-protection and sector obligations for the intended use; this guide is operational, not legal advice.