What are the guardrails of an AI agent?

The guardrails of an AI agent are the limits that set what it can do, with what permissions, and when it must stop and ask a person.

An AI agent does not just answer questions: it uses programs, reads and writes data, sends messages. The more it can do, the more damage it can do when it gets something wrong.

The risk guardrails cover

OWASP, the organisation that catalogues software vulnerabilities, calls this risk "excessive agency" and breaks it into three parts: too many functions, too many permissions, too much autonomy ¹.

There is also a subtler risk, prompt injection: instructions hidden inside a text the agent reads, such as an email or a web page, that try to make it do something else ². An agent that reads your incoming mail also reads the emails written by people who want to trick it.

The guardrails that matter for a business

These follow OWASP's recommendations ¹:

• Only the tools it needs. If the agent prepares quotes, it does not need access to everyone's mail.
• The lowest permission possible. Being able to read the management system does not mean being able to change it.
• A person approves high-impact actions: payments, messages sent to customers, deletions.
• Actions are logged, so you can work out what happened.

Questions to ask the provider

Before you sign, ask in writing: which systems does the agent access, and with what permissions? Which actions does it take on its own, and which does it ask me to approve? Where can I see what it did yesterday? How do I switch it off?

If the answers are vague, there is no guardrail.