A chatbot that gives a wrong answer wastes someone's time. An agent that takes a wrong action can issue a refund, delete a record, send an email to a customer, or move money. The moment you let a model call tools, you've handed it the ability to change the world — and you've created a new attack surface that your security team is right to worry about.
The good news: agents can be made safe using the same principles that govern any powerful automated actor in an enterprise. The mistake teams make is treating the model as trusted. It isn't. Treat it as an untrusted planner whose every action passes through controls you own.
The core principle: the model decides what to attempt; your infrastructure decides what is allowed. Never let the model's output be the thing that directly executes a privileged action.
1. Scope every tool to least privilege
An agent should be able to call only the tools a given task needs, and each tool should do the narrowest possible thing. "Query the orders database" is not a tool — it's a liability. "Look up the status of an order by ID, read-only" is a tool.
In practice that means: separate read tools from write tools; give each tool a typed, validated input schema so the model can't smuggle in a malformed or injected argument; and enforce the same authorization the calling user has, so an agent can never see or do more than the person it's acting for.
2. Make the Model Context Protocol the boundary
The Model Context Protocol (MCP) gives you a clean, standard seam between the model and your systems. Tools live behind an MCP server that you control; the model can only request them through that server. That boundary is where you put the enforcement — allowlists, argument validation, rate limits, per-tool authorization — instead of scattering it through prompt text the model can ignore.
This matters because prompt-based guardrails ("please don't delete anything") are suggestions, not controls. A determined prompt injection in a retrieved document will happily override them. Server-side enforcement at the MCP boundary can't be talked out of.
3. Put a human in the loop for anything irreversible
Not every action needs approval — reading a document doesn't. But anything that spends money, contacts a customer, or can't be undone should pause for a human. The pattern is simple: the agent proposes the action with its full arguments, a person sees exactly what will happen, and nothing executes until they approve.
Done well, this is not a bottleneck. Low-risk actions run autonomously; only the consequential ones surface for a one-click approve or reject. The result is an agent that moves fast where it's safe and asks where it isn't — which is exactly how you'd want a capable new hire to behave.
4. Audit every call as if you'll have to explain it
Every tool call — the inputs, the output, which user it acted for, and the model's stated reason — should be logged immutably. In a regulated environment you will eventually be asked "why did the system do this?", and "the AI decided to" is not an answer. A complete audit trail turns that question into a two-minute lookup.
Good logging also makes agents debuggable and improvable: you can replay a failed run, see where the plan went wrong, and tighten a tool or a permission rather than guessing.
Failure mode → control, at a glance
| Risk | Root cause | Control |
|---|---|---|
| Agent reads or changes data beyond the user's rights | Tool runs with broad service credentials | Enforce the calling user's own authorization |
| Prompt injection makes the agent misuse a tool | Guardrails live in the prompt, not the system | Server-side enforcement at the MCP boundary |
| An irreversible action fires by mistake | Model output executes directly | Human approval gate for write actions |
| "Why did it do that?" can't be answered | No record of tool calls | Immutable audit log of every call |
Where to start
Begin with the smallest useful agent: one or two read-only tools, behind an MCP server, with full logging. Prove it's reliable and observable before you give it a single write tool — and when you do, gate that write behind human approval from day one. Expand the agent's autonomy as your evidence (and your audit trail) earns it, not before.
This is the same discipline we bring to every agentic AI engagement: capable agents, but never at the cost of control.
Thinking about agents that take real actions in your systems? We can design the permission model and approval flow before a single tool goes live.
Talk to our team