Add autonomy one boundary at a time
- 1 · Observe
Start with read-only work
Effective agent systems are usually simple, composable workflows before they are open-ended autonomous systems. Begin with retrieval, classification or a proposed action so the team can inspect decisions without changing real state.[1]
- 2 · Approve
Put people at consequential gates
Generative AI risk management needs explicit governance, measurement and management. Require an accountable person to approve actions involving money, access, people, publication, deletion or Production changes.[2]
- 3 · Recover
Log the attempt and preserve rollback
As a workflow gains tools, evaluate the complete path rather than only the model response. Record inputs, tool calls, approvals and outcomes, and keep a tested way to stop or reverse the operation.[1][2]
An agent is a permission design
The model is only one part of the system. The meaningful boundary is what data it can read, which tools it can call and what each tool is allowed to change.[1][2]
Write one narrow outcome first. Grant only the data and actions needed for that outcome. If a normal rule or queue can complete a step reliably, keep the model out of that step.[1][2]
Read before write
A useful first release prepares rather than executes: it gathers evidence, drafts an update or proposes the next action. A person can compare the proposal with the source and reject it without cleanup.[1][2]
When measured results justify write access, add one bounded action. Keep Production credentials out of prompts and give each tool its own validated input contract.[1][2]
Approval must be placed before the side effect
A confirmation after an email was sent or a record was deleted is an audit message, not a control. Pause before the irreversible step and show the reviewer the target, evidence and exact proposed change.[2]
Avoid an approval screen that asks only whether the user trusts the agent. The decision should be specific enough that a busy reviewer can understand what will happen.[2]
Measure failure and recovery
Success rate alone hides the expensive cases. Track rejected proposals, tool errors, permission denials, manual corrections, rollback time and incidents where the workflow stopped safely.[2]
For an Australian organisation, nominate a business owner and a technical owner, map the data boundary, test representative exceptions and rehearse suspension before widening access.[2]
- One outcome and one accountable owner
- Least privilege per tool
- Human approval before consequential writes
- Tamper-evident action history
- Tested stop and rollback path