How much power should production AI agents get?
For that use real business tools, the hard part may be controlling what they are allowed to do, not choosing the model. If an agent can issue refunds, change a database, send emails, or read customer data, a mistake can affect real people and real money. Possible controls include giving one broad , setting fixed OAuth once, checking on every action, or requiring a human to approve risky steps.
The key test is whether a team can later prove exactly what an agent did and why that action was allowed. Real examples of agents doing something they should not do would show how serious this problem is in practice.
Key points
- agents may act on real systems, not just answer questions.
- Refunds, database changes, emails, and customer data access need strong limits.
- Common options include a broad , fixed OAuth , per-action checks, and human approval.
- Teams should be able to prove what the agent did and why it was allowed.
- Poor design can create costs that outweigh savings.
Sources covering this story (4)
- r/AI_AgentsHow much power should production AI agents get? ↗
- r/AI_AgentsA2A solved how agents talk. It didn’t solve what a stranger agent is allowed to do - how are you handling authz? ↗
- r/AI_AgentsShrinking an agent's blast radius: per-session tool allowlist + gVisor sandbox (open source, honest limits) ↗
- r/AI_Agentsrun coding agents in localised airlocked microVMs ↗