Every serious conversation about AI agents reaches the same question, usually from the person who would be accountable if it went wrong: what stops it doing something stupid or expensive in our live systems?
It is the right question, and it deserves a better answer than reassurance. The honest position is that an agent with unscoped access and no controls is a genuine risk — and that the engineering which removes that risk is well understood, unglamorous, and constitutes most of what building agents properly actually involves.
Control 1 — Scoped Permissions
The first and most important control has nothing to do with AI. An agent should hold credentials that grant access only to the specific records and actions its job requires — nothing broader — exactly as you would provision a new member of staff.
A follow-up agent needs to read deal records and send messages. It does not need access to payroll, supplier banking details or the ability to delete records. When people imagine agents going badly wrong, they are usually imagining an agent with far more access than it should ever have been given.
This is standard access control. It has protected systems from human error for decades, and it protects them from agent error identically.
Control 2 — Human Approval Gates
Certain categories of action should never execute without a person. Anything financial. Anything contractual. Anything legally binding. Anything irreversible — deletions, cancellations, public communication.
The important insight is how little labour this actually costs you. An agent can prepare a payment, match it to the invoice, verify it against the purchase order, confirm delivery was received, and present the complete package for one-click approval. The human keeps the decision; the agent removes the four hours of assembly that used to precede it. That is almost always the right division, and it is the one we design toward by default.
Control 3 — Complete Audit Logging
Every action an agent takes should be recorded with its trigger, the reasoning behind it, and its outcome — reviewable by management, finance and auditors.
This matters for two distinct reasons. Governance is the obvious one: if you cannot evidence what happened, you cannot answer to a regulator, a board or a client. The less obvious one is improvement — when an agent gets something wrong, the log tells you precisely why, so it is fixed rather than guessed at.
Worth noting: this typically produces better traceability than the manual process it replaced. Most manual processes have no audit trail at all beyond someone's memory of a phone call.
Control 4 — Supervised Deployment
No agent should go from build straight to autonomous operation. It runs on real traffic with a human reviewing its actions before they take effect, typically for one to three weeks.
This is where you learn how it behaves on your business rather than on a demonstration — your customers' actual phrasing, your genuine edge cases, the situations nobody thought to specify. Every deployment surfaces something the design document missed. Supervised rollout is how you find those while they are still cheap.
Any provider willing to skip this phase is telling you something important about how they work.
Control 5 — Escalation Rules and Uncertainty Handling
An agent must have an explicit answer to "what do I do when I do not know?" — and that answer must be to escalate to a named human with full context, not to improvise.
This is a design decision more than a technical one. Define upfront which situations are outside the agent's authority: unusual requests, disputes, anything touching a threshold, anything where the customer expresses frustration, anything the agent's own confidence flags as uncertain. Then make escalation clean — the human receives the full conversation and context, and the customer never has to repeat themselves.
What About Data Protection?
Businesses in Nigeria operating under the Nigeria Data Protection Act, and those serving European clients under GDPR, have specific obligations that agent deployments must respect: lawful basis for processing, data minimisation, retention limits, and the ability to respond to subject access and deletion requests.
Practically, that shapes several build decisions — which data the agent may retain and for how long, where it is processed and stored, what is excluded from its memory entirely, and how a deletion request propagates through the agent's stored context. These are answerable requirements, but they must be designed in from the start rather than retrofitted after a complaint.
The Risk of the Alternative
One thing gets consistently left out of this conversation: the current process has risks too, and they are rarely enumerated with the same rigour.
Enquiries lost because nobody replied for two days. Follow-ups forgotten under pressure. Customer conversations living on a personal phone that leaves with the employee. Pricing quoted inconsistently by different staff. Approvals sitting unactioned for a week. Reconciliation errors discovered at month end. No audit trail on any of it.
A properly built agent, with scoped permissions, approval gates, complete logging and defined escalation, is frequently the lower-risk option — not because it is infallible, but because it is consistent, observable and correctable in ways that a stretched human process is not.
Questions Worth Asking Any Provider
- What exactly can this agent access, and what can it not?
- Which actions require human approval, and how is that enforced technically?
- Show me the audit log for a real action — what does it record?
- How long is the supervised deployment period?
- What happens when the agent is uncertain, and who receives the escalation?
- What data is retained, where, and for how long?
- How do I turn it off immediately if I need to?
If a provider cannot answer all seven clearly and specifically, that is your answer about whether to proceed.
Harzotech builds AI agents with scoped permissions, human approval gates, complete audit trails and supervised rollout as standard on every deployment. Book an AI Agent Audit to discuss what safe deployment looks like in your business.