Creartful AIInsightsAgent guardrails
Keeping AI agents safe: access, approvals and prompt injection.
An agent that can read your inbox and update your store is useful exactly because it has access. That is also the risk. These are the guardrails we put in place before any agent touches real work.
Give it the least access it needs.
Every tool an agent can call is something it can get wrong. Connect only the systems its job needs, use read-only access wherever the job allows, and use separate accounts or keys so access can be revoked without breaking anything else.
Approve before it acts.
Anything that publishes, sends, spends or deletes should wait for a person. Agent frameworks support this directly: Anthropic’s Claude Agent SDK, for example, lets you set tools to always ask for permission. Claude’s own help pages advise allowing tools to run without asking only when you trust them.
Treat outside content as untrusted.
Emails, reviews, web pages and documents can contain text written to manipulate an AI, such as hidden instructions to forward data or ignore its rules. OWASP lists this, prompt injection, as the first risk in its list for applications built on large language models, and recommends limiting privileges and requiring human approval for high-risk actions.
In practice
- The agent treats content it reads as data, never as orders
- It cannot send data to addresses it found in that content
- Risky actions need approval no matter what the content says
Test it, and log everything.
Keep a set of test cases from your own past work and rerun it before changing the model, the instructions or the tools. Log every tool call and decision so you can see what the agent did and why, and review the logs regularly, not only when something goes wrong.
Teach it to stop.
The safest instruction an agent can follow is to hand a case to a person when it is unsure. Escalations are a sign the guardrails are working, not a failure.
Sources.
Can prompt injection be fully prevented?
Not with instructions alone. That is why the important protections are structural: limited access, approvals for risky actions and no ability to send data to unknown places.
Should an agent use my personal login?
No. Use dedicated accounts or keys with only the access the job needs, so you can see its activity separately and switch it off without affecting anyone else.
Who is responsible when an agent makes a mistake?
The business that runs it. That is why every agent we build has a named person who approves its important actions and reviews its logs.
Ready to work together?
Start at the Origin Point.
The Origin Point is the discovery call: one conversation about your site, your tools and what you want automated.