Agent safety
How much authority can this agent safely hold?
Set the smallest useful authority for each agent action, put human review before consequential effects, and rehearse a safe recovery path.
DECISION BRANCH
Answer the decision this topic actually owns.
- ASK FIRST↓
What does each read, write, message, or payment change, and who can approve it before execution?
- IF↓
Authority, review placement, and timeout recovery pass a drill: increase autonomous scope one action at a time.
- OTHERWISE✓
Keep read-only or draft mode, name the human owner, and block unapproved external effects.
WORKED CASE
May a refund agent proceed all the way to payment?
The agent reads tickets, queries orders, calculates refunds, writes to CRM, and may call a payment tool. Read-only steps and balance-changing actions sit inside the same workflow.
Add one human confirmation at the final button without showing evidence or changes, and ignore duplicate requests and tool timeouts.
Assign authority by action: reads may run, CRM drafts stay reversible, and payment requires one approval bound to the order and amount. Show evidence and effects before payment; name an operator to handle unknown results.
Rehearse duplicate requests, payment timeouts, abnormal amounts, and rejected approvals. No duplicate refund occurs, partial success has an owner, and the operator can continue, reverse, or close from the record.
ENTRY & EXIT SIGNALS
Know when to enter—and when the decision is good enough to leave.
A topic is not an endless knowledge directory. Entry signals tell you whether the problem belongs at this layer. Exit signals decide whether to continue instead of substituting time spent reading for work completed.
- An agent action may write, notify, or issue payment
- Reviewers cannot see the evidence or approval scope
- Repeated execution or partial success has no recovery owner
- Consequential actions have the smallest useful permission and exact approval scope
- A reviewer can reject or change the action before execution
- A timeout, repeat, or partial success has been rehearsed to a safe result
5 PRACTICES
Build the judgment, make the artifact, then review it with real cases.
BOUNDARY
What this topic page will not do
The permission ladder guides control design; it is not organizational authorization or a security certification. Verify reversibility in the real system.