How to Use AI Agents Safely

With a chatbot, the worst outcome is a wrong answer — annoying, but you catch it before anything happens, because you're the one doing everything. An agent is different: it acts. It sends, moves, books, buys. Mostly that's the point and the joy of it. But it means a mistake can happen in the world, not just in the chat window.

The good news: keeping agents safe requires no technical skill at all. It requires exactly the management instincts you'd use with a bright new intern on their first week.

Hold this one mental model and every rule below becomes obvious: treat every agent like a talented, fast, tireless, slightly overconfident new intern.

You'd absolutely give an intern real work — that's why they're there. You would not give them the master keys, the company credit card, and zero supervision on day one. Capability isn't the question. Boundaries are.

Give an agent access to what the task needs, and nothing more. Sorting your tax documents? It needs the Tax folder — not your entire drive, not your email, not your photos.

Every connection you grant is a door the agent may open. Fewer doors doesn't just mean fewer risks — it means mistakes stay small and findable.

Sort every agent action into two buckets:

Reversible — reading, drafting, organising, summarising, calculating. Let the agent run freely here; anything wrong can be undone with a click.

Irreversible — sending an email, deleting files, making a payment, publishing a post. Here the agent prepares and proposes, and a human clicks the final button. In the dinner-booking example from our first article, that's the agent asking 'Shall I confirm?' before booking. That one question is the entire safety model, working.

Agents loop — and a stuck loop happily burns time and money while looking busy. So cap everything cappable: steps, minutes, and spend per task. Most agent tools have these settings; use them.

A sensible cap turns the worst case from 'surprise $200 bill' into 'it stopped at $5 and asked me what to do' — a shrug instead of a story.

Review agent output the way a good manager reviews a new hire: closely at first, then progressively lighter as trust is earned per kind of task.

One practical trick beats all others: define what 'done' looks like before the agent starts, then check that — spot-check three of the renamed files, skim the summary against one original source, confirm the booking email arrived. Never grade an agent by its own confident report of success.

Never paste passwords, card numbers or private keys into a conversation with any AI. When an agent needs access, use official permissioned connections (that's the MCP plumbing from earlier in this track) — access you can see listed, limit, and revoke, without your secret ever being in the chat.

One subtler danger deserves a mention: an agent that browses the web reads whatever the web says — and a malicious page can contain hidden text designed to trick the agent into misbehaving. It's called prompt injection, and it's the star of the next article. For now, the defence is the rules you already have: small doors, and approvals on anything that sends or spends.

1. 1Give the agent one folder / one inbox / one job — not your digital life.
2. 2Turn on approval steps for anything that sends, deletes or pays.
3. 3Set a budget cap before the first run, not after the first bill.
4. 4Define 'done', then verify a sample of the work yourself.
5. 5Grant access through revocable connections; never paste secrets.