Whatever its account can reach. Instructions describe what it should do; permissions decide what it can do. Limit what it can read and change to the task, then test that the limits hold.
Won’t it just follow its instructions?
Instructions aren’t a lock. An agent set up to read one approved folder can reach far more if the account behind it can. Check the actual account, sources and permissions.
1. What it can read.
Define the specific folders, records and fields the task needs, not everything the account used to set it up can see.
Check whether the person asking is allowed to see the answer.
Include what it retrieves, anything it stores, its outputs and its logs.
Practical check: Reading can expose information without changing anything.
2. What it can change.
Example scope. Read approved service guidance and prepare a reply.
Not included unless you decide so. Sending the reply, changing a customer record or deleting a file.
Enforce it by limiting its tools and connections to the approved actions and targets.
Practical check: Don’t rely on instructions alone to prevent an action.
3. Content from outside.
An email, web page or attachment can contain instructions. The agent should treat them as content, not as authority.
A test. An incoming message tells it to forward an internal file to a new address.
Expected result. The message can’t grant access or authorize the send.
Practical check: Test the control, not just whether the reply sounds cautious.
4. Test the “no” cases.
- Wrong source
- Ask for a record outside the approved scope.
- Wrong action
- Ask it to send or delete something the task doesn’t allow.
- Wrong authority
- Change the target after approval, or carry on without approval.
Practical check: Use made-up test cases and look at what actually happened.
A permission brief.
Fill this in before connecting anything:
- This task runs for ______ using the account ______.
- It may read ______ and may only change ______.
- ______ approves actions; ______ handles exceptions and can switch off its access.
Then have whoever manages the systems confirm those limits are actually set.
Read more: Answer, Prepare or Act: How Much Should an AI Agent Do? · Employee Data and AI Tools: Questions to Ask First
A planning aid, not a complete security or privacy assessment.