When I first show someone an agent working on their email, the first few minutes are excitement. Then comes the question. Usually asked carefully, as if it were a silly one:

„What if it writes something stupid to a client?“

It is not silly. It is exactly the right question, and anyone thinking about letting AI near their real data should ask it. I ask it myself for every agent I build. This article is my answer - three safeguards, without which an agent of mine does not touch anything that can be seen from the outside.

Why that fear is justified

I have been in IT for 18 years and the vast majority of disasters I have seen did not come from bad intent. They came from good will combined with speed. Someone wanted to help, acted fast and did not have the full picture.

An agent is exactly that, only much faster. It is speed without context. In a minute it gets through more than an intern does in a summer - and that holds for useful work and for damage alike.

One difference from a person matters most. A junior who deletes the wrong file twice starts to hesitate and comes to ask. An agent does not. It has no feeling in the stomach telling it that this is going too far. That is not its fault, it simply lacks what you have from ten years in the field: the hunch that this particular action cannot be undone.

So with an agent my first question is not how clever it is. It is how far it can reach.

Safeguard 1: it never gets the passwords

The most common mistake I see with people who build an agent themselves is a password written straight into the instructions. Into the prompt, into a config file, into a shared spreadsheet. „Log into the invoicing system, the username is this, the password is that.“

That is not how it works with me. The agent gets a reference to the password, never the password itself. The real credentials sit in a vault the agent cannot see into. When something needs doing, the system logs it in on its behalf.

Why this matters in practice: an agent handles text written by other people. Emails from strangers, PDFs from suppliers, the contents of web pages. And that text can carry a hidden instruction trying to manipulate the agent. It is called prompt injection, and it is not theory, it happens. When it works, the attacker gets whatever the agent has at hand. And if it has no password at hand, there is nothing to steal.

Same principle as giving the maintenance guy a door fob instead of a copy of the master key. He gets in, but he cannot walk away with the key.

Safeguard 2: it may only do what you explicitly allow

Intuition says to write a list of forbidden things. Do not delete, do not send money, do not cancel meetings.

Forbidding is a losing battle. There is always another route to the same outcome that you did not think of when writing the list. That is not a flaw of AI, it is a property of any list of prohibitions - it is never complete.

I turn it around. The agent has a list of what it may do, and everything outside that list does not exist for it.

For an email sorting agent it looks like this: it can read the inbox, it can create labels, it can save a drafted reply into your drafts. It cannot send email. Not because sending is forbidden - that ability was simply never given to it. However hard anyone talks it into sending, it has nothing to send with.

The difference between forbidden and unavailable is the whole point. Forbidden can be worked around. Unavailable cannot.

Safeguard 3: anything going out waits for your OK

Split the agent's work into three categories:

Reading. Going through the inbox, finding things in documents, adding up numbers. No asking here, there is nothing to break.

Preparing. Drafting a reply, lining data up in a spreadsheet, putting a summary together. No asking either - you look at the result before you use it anyway.

Acting outward or irreversibly. Sending a client an email, sending a payment reminder, deleting data, changing something on your website. This is where it stops. The agent prepares what it would do, puts it in front of you and waits. Until you click, nothing happens.

This is exactly what I mean when I say the routine disappears but control stays with you. You are not writing those replies. You are only deciding which ones go out.

And now the uncomfortable truth nobody selling AI will tell you: this will slow you down at first. For the first few weeks you will be approving things the agent could handle alone, and a few times you will think you would have written it faster yourself. That is normal, and it is the price of learning its handwriting before you let it go further.

When to move the line

These safeguards are not meant to stay fixed forever. They are meant to loosen based on what you see.

After a few weeks you have a record of what the agent proposed and what you did with it. When you approve one specific type of task fifty times in a row without editing it, that task is a candidate for loosening. When you rewrite something every single time, that one stays where it is.

Move category by category, not across the board. Letting it confirm meeting times on its own is a sensible step. Letting it send whatever email it likes is not.

And what I never loosen, not even after a year in production: anything with a price on it, anything with legal consequences, anything that cannot be taken back. A quote, terminating a contract, deleting data, changing bank details. There the click stays forever. Not because I do not trust the agent, but because a mistake in that category costs more than all the time it could ever save me.

And when a safeguard fails?

No safeguard is absolute. Which is why there is a fourth thing I do not even count as a safeguard, because it is a given: a record of everything the agent did.

When something happens, you want to know what, when and on what basis. Without a record you are guessing, and the only move left is switching the agent off. With a record you find the exact spot, fix the rule and carry on.

This, by the way, is why I do not recommend building an agent as a black box you cannot see into. Not for technical elegance. Because the first unpleasant surprise will come and you will want to know why.

In short

I trust that an agent means well. I do not trust that it understands the consequences of what it does. For now, that experience is what I have to supply.

So the three safeguards are not a brake on enthusiasm. They are the reason an agent can go into real production at all without costing you your sleep.

If you are considering letting AI near your data and you are not sure where to draw the line, book 15 minutes on the phone, free. Tell me what the agent should do and we will go through what it would be allowed to do at your place and what it would not. Even if the answer turns out to be that building it now does not pay off, you will know.