How do you control what an AI agent is allowed to do?
You control an agent by giving it an owner and explicit limits, checking those limits at the moment of the action rather than at sign-in, and keeping a record of what was decided. The check must be able to refuse, and a refusal must stop the call.The short answer
An agent needs three things before it can be trusted with a real action: an identity that names the agent and the person or team behind it, a permission that says what it may access, spend or change, and a check that runs before the action and can stop it. Instructions in a prompt are not a limit, because the model can be talked out of them. A limit that runs in the caller cannot be.Set the limits
A missing, expired or revoked permission grants nothing. Control agent actions covers each field with examples.
Check at the boundary
The check belongs where the tool call happens, not in the prompt and not only in the logs afterwards.Keep proof of each decision
A limit you cannot demonstrate is hard to rely on. Each check can leave a proof that records which agent acted, which permission applied, and whether the call was allowed or refused, so the next system can check it without repeating the work. Prove what happened and Reuse verification cover the record and its reuse.Common ways this goes wrong
- The limit lives in the prompt. A prompt instruction is advice. Keep the limit in the caller that owns the tool.
- The check runs after the action. A check in the logs describes what already happened. It has to run before.
- The agent has no owner. Without an owner there is nobody to hold responsible and nobody who can revoke.
- Permission never expires. An approval given once should not last forever without a decision.
- A denial loses to an allowance. When both match, the denial has to win, or the narrower rule is meaningless.
Where to go next
Control agent actions
Set each limit and load it where the tool runs.
First guarded action
Run one allow or deny decision end to end.
Agent identity
Name the agent and its owner.
Proofable or a policy engine
When to keep your own engine and what to add.