Agentic action safety

When to use it

Reach for this when someone says any of these — they are the phrases the skill itself triggers on:

• “what can the bot change on an account”
• “agent tool permissions”
• “AI agent safety bounds”
• “dry run before refund”
• “limit bot actions”

How it works

The method, in the order the skill runs it. The full procedure — tables, worked examples and the edge cases — is in the skill itself.

1. Inventory actions by blast radius

   List every tool, API, or integration the agent can invoke. Classify each.

2. Allowlists, not open-ended tools

   If a human agent needs a manager for an action, the bot should not have unattended access to that action.

3. Irreversible and high-tier actions

   For financial, entitlement, and destructive classes: No silent auto-execute, Idempotency keys, Amount and rate limits per conversation, customer, and day, Cool-down after policy or prompt change until re-validated.

4. Dry-run mode

   Implement dry-run (or shadow execution) before first production write: Tool returns what would happen without committing, Log proposed mutations with conversation id and model version, Compare dry-run log to human expectation on a labelled set.

5. Audit trail

   Every mutation via agent must log: Conversation / session id, Tool name and parameters (redact secrets), Model and prompt version, Initiating actor (bot vs human-approved), Before/after state snapshot or reference, Timestamp and correlation id for support lookup.

6. Bounding blast radius

   Additional limits beyond allowlists: Scope to current customer, No batch or cross-customer operations from conversational agents, Circuit breakers, Kill switch.

7. Alignment with human policy

   Map each allowed bot action to documented human authority levels. If policy says "agents may credit up to £X", the bot's cap is ≤ £X, not higher because the model asked nicely.

Related skills

• AI agent evaluationTest an AI agent before shipping a prompt or model change
• Bot safety auditFind where a bot did harm, and where it was pushed to
• Trusting an AI graderCheck an AI grader agrees with your humans before trusting it
• Copilot evaluationMeasure whether the copilot actually helps agents
• What the bot can findFix what the bot retrieves before blaming what it says
• Where humans approveDecide where a human has to approve, and what that costs