Short answer
Before an AI agent takes actions on its own, such as sending messages, updating records or running multi-step tasks, put five controls in writing:
- Permitted actions: exactly what it may and may not do
- Human checkpoints: which actions need a person's approval first
- Logging: a record of everything it did and why
- Reversibility: how each action can be undone
- A stop switch: who can restrict or halt it, and how
Then start with a narrow task, limited data access and close review.
What makes an agent different
A chatbot answers. An agent acts. It can send an email, change a record, book a meeting or chain several steps together with limited human direction. That is what makes agents useful, and it is also why the controls matter more: a wrong answer can be ignored, but a wrong action has to be found and reversed.
The five controls
These five controls follow the review points the Conference of State Bank Supervisors gives state examiners for AI systems that can take actions with limited human direction (procedure GE-8 in its Core Examiner Guide). They are written for banks, but they are a sound standard for any business.
| Control | What to define | Example |
|---|---|---|
| Permitted actions | The specific actions allowed, and everything that is not | May draft and send appointment reminders; may not change prices or cancel orders |
| Human checkpoints | Actions that need approval before they happen | Any message to a new customer is reviewed before sending for the first month |
| Logging | What is recorded for each action | Time, action taken, data used, outcome |
| Reversibility | How each action is undone | Record changes are versioned; sent messages have a correction process |
| Stop switch | Who can pause or halt the agent, and how quickly | The operations lead can disable it from one setting |
The examples are illustrative.
The risks to plan for
Two risks from the OWASP Top 10 for LLM Applications (2025) matter most for agents:
- Prompt injection (LLM01). Instructions hidden in content the agent reads, such as an email or a web page, try to change what it does. Treat everything the agent reads as data, not instructions, and limit what it can do with that data.
- Excessive agency (LLM06). The agent is given more permissions, tools or autonomy than its task needs. Give it the minimum access required, and nothing more.
Inaccurate output and data exposure matter too. An agent that can read customer data and send messages needs both data limits and output review.
A practical rollout
- Pick one narrow, reversible task, such as drafting follow-up messages for a person to approve.
- Limit data and tool access to what that task needs.
- Start with approval on every action, then relax checkpoints only where the log shows the agent is reliable.
- Review the log weekly for the first month.
- Write down the five controls and who owns each one.
Frameworks worth knowing
- The NIST AI Risk Management Framework (AI RMF 1.0, released January 26, 2023) is a voluntary framework for managing AI risk. Its Generative AI Profile (NIST AI 600-1, released July 26, 2024) applies it to generative AI.
- The OWASP Top 10 for LLM Applications lists the most common security risks for applications built on large language models.
How we apply this
Our custom AI development work builds these controls into the agent from the start: defined actions, approval steps, logging and a way to stop it. For regulated institutions, our AI readiness and governance work documents them so they can be shown to examiners and boards.
Sources
- CSBS, Artificial Intelligence Supervisory Framework: Core Examiner Guide, Version 1.0 (procedure GE-8)
- NIST AI Risk Management Framework and Generative AI Profile (NIST AI 600-1)
- OWASP Top 10 for LLM Applications 2025, summarized by Invicti
Related service: Custom AI development · All articles · AI automation · AI visibility