This guide is for a practitioner evaluating a bounded AI-agent workflow at work. It focuses on permissions and control—not a general list of possible use cases. AILooma has not tested a particular vendor or deployment. Use approved accounts and non-sensitive test material until the system’s data path is understood.
1. Write the allowed task and prohibited actions
Describe the input, output, owner, and completion condition. List actions the agent must not take, such as sending a message, changing a production record, or approving a transaction without human review.
2. Give only necessary permissions
Begin with read-only scope if possible. Keep credentials in the platform’s approved secret store; do not paste keys into prompts, notes, or logs. Review which documents, accounts, and external services the agent can reach.
3. Insert a human approval checkpoint
Before a write, send, or irreversible action, show the proposed change, target, and source evidence to an authorized reviewer. Require explicit approval and record who approved it. If the platform cannot support an appropriate gate, keep the workflow in suggestion-only mode.
4. Log decisions without retaining excess data
Keep enough information to diagnose an error: workflow version, tool call, outcome, and approval. Minimize prompt and personal-data retention, restrict log access, and set a retention period. Logging is useful only if the stored data is protected and reviewed.
5. Test failure and recovery paths
Use a sandbox or reversible sample task. Test missing input, duplicate events, an unavailable tool, conflicting sources, and a request outside scope. Define how to stop execution, undo a change, and escalate an incident before live use.
6. Monitor and revisit
Assign an owner to review failures, permission changes, and vendor updates. NIST’s AI Risk Management Framework and Microsoft’s agent safety guidance are useful starting points, not a substitute for a system-specific threat and impact review.
Use an action ladder for permissions and approval
List each connected action before enabling an agent. Start at the least-authority level that can help: read approved material, prepare a draft, propose a change, or execute a change. Keep sending, deleting, publishing, spending, and changing access behind a person’s explicit approval unless an accountable security owner has approved a narrower documented exception. Microsoft’s agent safety guidance also recommends validating tool inputs and gating high-risk operations behind human confirmation.
Approval should show the action, not just a summary
Before a reviewer approves a write, show the target record, exact proposed change, source evidence, affected people, and whether the action can be reversed. Do not let a model both generate an action and certify that the action is safe. Record the approver and result using the organization’s approved audit mechanism, while minimizing sensitive prompt or customer data in logs.
Write the failure and rollback card
- Duplicate event: pause side effects and reconcile using a stable request identifier.
- Missing or conflicting source: stop and route to the named owner; do not guess.
- Unexpected write: disable the integration, revoke its credential if needed, restore the prior value, and notify the owner.
- Provider or permission change: re-check the data path and approval settings before resuming.
Keep one documented manual fallback and a person who can activate it. For redesigning a team’s whole process, not just controlling one deployed workflow, see the governance-first workflow guide.
Related reading
For a list of candidate tasks and risk boundaries, use the use-case matrix. For a broader prototype lifecycle, see the developer checklist.
About the author
Femica Maydinda Harend writes practical technology guides for AILooma focused on understandable workflows and responsible boundaries.
Editorial note
This is general information, not a security review or legal advice. Features and controls vary; consult current vendor documentation, your security team, and applicable policies.