We put AI agents to work against real systems. Not in a sandbox, not as a conference demo, but against the environments we and our customers work in every day. When I say that, I almost always get the same question back, usually with a slightly raised eyebrow: how do you dare?
This piece is my answer. And that answer is not about permissions.
The scenario that does keep me awake
Picture this: an AI agent is told to "clean up the environment". With the best of intentions, neatly within its permissions, it starts tidying. It just interprets "clean up" a little more broadly than intended, and deletes a production database that nobody is getting back. No malice, no hack, no rule broken. Just an agent doing what it was allowed to do.
I have been in IT for thirty years now and I have watched plenty of incidents up close, but this type of risk is new. It is not about someone breaking in. It is about something inside your own environment acting entirely legitimately and still causing damage. That is exactly the scenario organisations should be losing sleep over now that AI agents are moving from experiment to daily practice. The question is no longer *whether* we deploy agents, but how we do it responsibly: against real systems, with real consequences.
Authorization answers the wrong question
Most discussions about AI safety are about authorization: who is allowed to do what? We give an agent a set of permissions and assume it will behave neatly inside them. That is necessary, but it does not solve the real problem.
Authorization answers the question "is this action *permitted*?", not the question "is this actually the intention, right now, in this context?". An agent with legitimate access to a customer system can do something irreversible entirely within its rights. An agent that is instructed poorly, subtly misled, or simply takes an instruction too literally stays neatly inside the lines and still causes damage. Permissions define the playing field; they say nothing about the individual move.
That is the insight I had to sit with for a moment. With a colleague, we fill that gap automatically. People have judgement, hesitation, and the reflex to walk over to someone before doing something irreversible. That reflex is exactly what an agent lacks, unless we build it in. And building it in is not a model choice or a prompting question. It is architecture.
Two risks you need to separate
In the conversations I have about this, two things often get mixed up. Both demand an answer, but they are not the same problem.
The first is better known than it is addressed: credentials in prompts. Letting API tokens, keys, or other secrets end up directly in an AI agent's prompt or context creates a leak you cannot undo. That data spreads invisibly into log files, transcripts, memories, and intermediate layers you never labelled as "sensitive". My own rule of thumb is simple: a secret that lands in a prompt even once is treated as compromised. Full stop.
The second risk is more dangerous and gets far less attention: an agent that can then use those credentials on its own. The moment an agent holds the keys to carry out real actions, in production, against customer systems, with lasting consequences, authorization is definitively no longer enough. A compromised, misled, or simply overenthusiastic agent then acts entirely within its permissions, at full speed, without pausing. And speed is precisely why we deploy agents: by the time a human notices something is going wrong, a hundred actions have already been executed.
How we solve it: deliberate approval up front
The solution that works for us is simpler than people expect. Sensitive, irreversible, or business-critical actions do not go straight from the agent into the world, but through a control layer with a human approval step. The agent prepares an action; a human deliberately confirms it before execution. Only after that confirmation does anything happen.
Two properties make this principle valuable. First, the approval is explicit and up front: not an after-the-fact review of what already happened, but a conscious decision at the moment it matters. Second, and just as important: the credentials themselves stay out of the agent's reach. The agent never has to see or hold the keys to do its work. It requests an action; the layer underneath executes it with secrets the agent never gets its hands on. That removes both risks at once: the leak risk and the risk of independent misuse.
I notice people first hear this as a brake on AI. My experience is exactly the opposite. Without this layer, an AI agent stays a toy for the sandbox, safe as long as it cannot touch anything real. With this layer, I am willing to let it loose on an environment where mistakes cost money, data, or trust. The approval step is not the obstacle between you and the value of AI, but the key that opens the door to it.
From experiment to demonstrably responsible
For organisations that take governance and accountability seriously, there is a welcome side effect. Every significant action confirmed by human hands is by definition a moment you can record, explain, and account for. When your auditor or your customer asks who approved something and why, you have an answer instead of a log file full of agent output.
That is how we dare to put AI agents to work against real, business-critical systems: precisely because the important, irreversible actions are not executed by the agent itself, but run through that approval layer. It combines the speed and scalability of AI with the certainty a production environment simply demands. To me, that is the difference between "we are experimenting with AI" and "we dare to let AI do the real work".
It is the same line of thinking I described earlier around your choice of AI model and safely hosting your own AI apps: it is not the model or the agent that determines what happens to your data and your systems, but the layer you build around it.
Let's talk
Are you considering taking AI agents beyond the sandbox, against production, against customer systems, against data that matters? Then the question is not whether it *can* be done, but how you do it responsibly. I am happy to think it through with you. Get in touch for a conversation about deploying AI agents safely, accountably, and with confidence, without giving up speed.
