An agent takes actions.<\/strong> A single-step AI feature produces text somebody reads.<\/p>\n That difference changes the risk entirely.<\/strong> A bad draft is discarded. A bad action has already happened.<\/p>\n Six risks worth understanding<\/strong>, and what controls each one.<\/p>\n The main risk.<\/strong><\/p>\n An agent misreads a situation, chooses a tool that seemed reasonable, and acts. Nothing errors.<\/strong> It reports success.<\/p>\n Why it happens:<\/strong> an agent chooses tools from their descriptions and from what it judges the situation to require. A misjudgement produces a confident wrong action.<\/p>\n The control: permissions, not instructions.<\/strong><\/p>\n You cannot reliably instruct an agent out of a capability.<\/strong> Telling it “never delete records” is weaker than not giving it the ability to delete.<\/p>\n Practically:<\/strong> a dedicated account with the minimum rights the task needs. Read broadly, write narrowly, and no ability to do anything you would not want done.<\/p>\n An agent that cannot tell whether the goal is met keeps going.<\/strong><\/p>\n Retrying the same failed step. Cycling between two actions. Working through records indefinitely.<\/p>\n Three controls:<\/strong><\/p>\n A step limit.<\/strong> After a set number of actions, stop.<\/p>\n A record limit.<\/strong> Process at most a set number in one run.<\/p>\n A stop mechanism<\/strong> that works immediately.<\/p>\n Test all three before relying on it.<\/strong> A stop button nobody has pressed is a button that has never worked.<\/p>\n FIGURE 1: THE CONTROLS THAT MATTER MOST<\/p>\n Minimum permissions<\/p>\n Stop before commit<\/p>\n Step and record limits<\/p>\n Full logging<\/p>\n A wrong step produces a wrong record, and the next step treats it as fact.<\/strong><\/p>\n By the time anything looks odd, several things are wrong \u2014 and they are connected, so unpicking them is harder than fixing one.<\/p>\n The control:<\/strong> limit how much happens without review.<\/p>\n A run that prepares twenty drafts is recoverable.<\/strong> One that created twenty records across three systems is a cleanup exercise.<\/p>\n An agent takes a path, and the path varies.<\/strong><\/p>\n When the outcome is wrong, “why did it do that” is a real question \u2014 and without a record it is unanswerable.<\/p>\n In a business system that matters twice over:<\/strong> you cannot fix what you cannot diagnose, and you cannot explain to an auditor a result you cannot trace.<\/p>\n The control: log every step.<\/strong> What it decided, which tool it called, what came back, what it did next.<\/p>\n Not a summary.<\/strong> The sequence.<\/p>\n There is no partial capability.<\/strong> An agent with the ability to post journal entries can post wrong ones.<\/p>\n And this compounds with the first risk.<\/strong> A misjudgement plus broad permissions is how a small error becomes an expensive one.<\/p>\n The control:<\/strong> treat the agent’s account like any other user account. Minimum rights. Reviewed periodically. Not an administrator.<\/strong><\/p>\n The quiet one.<\/strong><\/p>\n An agent producing drafts is safe only if somebody reads them.<\/strong><\/p>\n What happens in practice:<\/strong> the drafts are good for three months, review becomes skimming, and then one bad one goes out.<\/p>\n Two controls:<\/strong><\/p>\n Make review a real step<\/strong>, not a formality. Somebody with the knowledge to spot a wrong draft.<\/p>\n Sample deliberately<\/strong>, even after you trust it. A fixed proportion, checked properly.<\/p>\n FIGURE 2: TWO WAYS AN AGENT IS DEPLOYED<\/p>\n Controlled<\/p>\n Risky<\/p>\n Stop before the commit.<\/strong><\/p>\n If an agent never does anything irreversible, most of the risk disappears.<\/strong><\/p>\n A wrong draft is discarded. A wrong list is corrected. A wrong summary is ignored.<\/p>\n The value is preserved<\/strong>, because gathering and preparing is where the time goes \u2014 not the final click.<\/p>\n When you might relax it:<\/strong> never, for anything touching money, going to a customer, or that an auditor might examine.<\/p>\n Possibly, for low-consequence internal actions<\/strong> where the cost of being wrong is genuinely small and reversal is easy. That is a shorter list than it first appears.<\/strong><\/p>\n Test the failure cases, not the happy path.<\/strong><\/p>\n That fourth one matters.<\/strong> An agent that always finds something to do will do something unnecessary. “Nothing needs action” has to be an acceptable outcome.<\/strong><\/p>\n Six.<\/p>\n What can it do without a person confirming?<\/strong> If the answer is anything meaningful, ask why.<\/p>\n What account does it run as, and with what rights?<\/strong><\/p>\n How do we see what it did?<\/strong><\/p>\n How do we stop it?<\/strong><\/p>\n What happens when it meets something unexpected?<\/strong><\/p>\n Who reviews the output, and will they actually read it?<\/strong><\/p>\n Vague answers to any of these are a reason to wait.<\/strong><\/p>\n FIGURE 3: BEFORE YOU ADOPT ONE<\/p>\n What can it do unconfirmed?<\/p>\n What rights does it run with?<\/p>\n How do we stop it?<\/p>\n Who actually reads the output?<\/p>\n None of this means avoid agents.<\/strong><\/p>\n It means the controls are the design<\/strong>, not an afterthought. An agent with minimum permissions, a commit boundary, limits, logging and a real review step is genuinely useful.<\/p>\n The same agent without those is a liability that looks like a capability<\/strong> \u2014 and the difference does not show until the exception arrives.<\/p>\n Control with permissions, not instructions.<\/strong> If you do not want something to happen, remove the ability.<\/p>\n Stop before anything irreversible.<\/strong> That single boundary removes most of the risk while keeping most of the value.<\/p>\n Set and test step limits, record limits and a stop mechanism.<\/strong><\/p>\n Log every step<\/strong>, because “why did it do that” is a question you will eventually ask.<\/p>\n And make sure somebody actually reads the output.<\/strong> Drafts nobody reads still get used.<\/p>\n Considering an agent for something that touches your systems?<\/p>\n Get in touch. We will go through the permissions, the commit boundary and the logging before anything is built \u2014 those decide whether it is useful or a liability.<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":" Why this needs its own article An agent takes actions. A single-step AI feature produces text somebody reads. That difference changes the risk entirely. A bad draft is discarded. A bad action has already happened. Six risks worth understanding, and what controls each one. 1. It does something you did not intend The main risk. […]<\/p>\n","protected":false},"author":3,"featured_media":9486,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-9485","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai"],"yoast_head":"\n1. It does something you did not intend<\/h2>\n
2. It loops<\/h2>\n
\n
\n
\n
\n
3. Errors compound<\/h2>\n
4. You cannot explain what happened<\/h2>\n
5. It inherits access wholesale<\/h2>\n
6. Nobody reviews the output<\/h2>\n
\n
\n
The control that does most work<\/h2>\n
Testing before you trust it<\/h2>\n
\n
Questions before adopting one<\/h2>\n
\n
\n
\n
\n
A proportionate view<\/h2>\n
The short version<\/h2>\n