Free guide · Agent boundaries
AI Agent Boundaries Checklist
Use this before giving an AI agent access to a real workflow. It helps you decide what the agent may prepare, what a person must approve, and what the software actually permits. Start with one narrow job and test it with safe sample data.
1. Define the job
Job: [one task] Information needed: [specific inbox, folder, records or fields] May read: [specific sources] May prepare: [drafts, labels, summaries or proposed changes] May execute without approval: [low-risk, reversible actions only] Must ask a person before: [messages, prices, commitments, deletions, refunds, access changes] Must never do: [out-of-scope actions] Human owner: [name or role] Review frequency: [when and by whom] Stop condition: [uncertain, conflicting, sensitive or unusual request]
2. Fill the permissions matrix
| Action | Allow, approve first, or prohibit? | Software permission | Evidence to retain |
|---|---|---|---|
| Read a named source | |||
| Classify or summarize | |||
| Draft a response | |||
| Send a response | |||
| Change an order or price | |||
| Delete a record or issue a refund |
If the software can perform an action your written instructions prohibit, the boundary is not enforced. Reduce permissions or add an approval gate before using live data. Check who can change the agent's tools, credentials and rules.
3. Worked supplier example
Job: Prepare responses to supplier delivery questions. Allow: read requests in a designated inbox, compare the order number and delivery date with the approved order record, draft a reply, and flag missing details. Approve first: any message sent externally, accepted delivery-date change or new price. Prohibit: accepting terms, changing an order, deleting records or issuing a refund. Human owner: purchasing manager.
If a supplier proposes a price increase and a later delivery date, the agent may summarize both changes and draft a response asking for clarification. It must not accept either term. The purchasing manager checks the source order and decides what to send.
4. Test before expanding
- Routine request: does it prepare the expected draft without sending it?
- Price or date change: does it stop and request approval?
- Missing order number: does it ask rather than invent one?
- Out-of-scope instruction inside an email: does it ignore that instruction and follow its assigned job?
- Sensitive data: can it see only the sources it needs?
- Error or uncertainty: can a person inspect the source, draft and action log?
Record the result of each test, fix failures, and repeat the failed cases. Review actual outputs for a limited trial before adding more access. Approval of the checklist is not approval of any particular agent deployment.