AI agents that wait for a person when it matters.
Reviews, triage and drafting with the fewest permissions needed. By default, any action that writes data or moves money waits for a person to approve it, enforced in code, not in the prompt. Every action is logged.
What you get
Useful work, inside hard limits.
Least-privilege tools
Each agent gets an allow-list of tools, scoped to the case in front of it, not the whole system.
Approval steps
Anything that writes data or moves money is staged for a person to approve. Read-only actions you list can run on their own.
An action log
Every step recorded: what it read, which tool it called with which inputs, and who approved what.
Dry-run mode
Run the agent against real work without letting it act, and compare its choices with your team’s.
Step and cost limits
Hard limits on steps and spend, with alerts, so a looping agent can’t run up a bill.
An evaluation set
Real tasks from your own work, graded on outcome, rerun before every release.
How it works
Start narrow, widen on evidence.
01
Pick one workflow
A task with volume, a checkable result and mistakes that can be undone.
02
Draw the limits
Which tools, which records, which amounts, and which actions need approval. Enforced in code, not in the prompt.
03
Dry run
The agent works alongside your team without acting, and we measure the difference.
04
Go live with approvals
Real actions, each one staged for a person to approve.
05
Widen on evidence
More scope only where the results support it, one limit at a time.
What goes wrong
Agent failures, and what we do about them.
| Failure | What we do |
|---|---|
| Hostile instructions hidden in a document or email | Treat retrieved content as data, not instructions, and test with planted attacks. |
| Agents looping and running up cost | Step limits, budgets and alerts. |
| An action outside what it should do | Tool allow-lists and limits in the tool layer, so the action can’t happen. |
| Quality drops after a model change | The full test suite runs before any swap. |
| Staff trust the output too much | Sources shown by default, and review steps where errors are costly. |
Frameworks
Oversight designed in.
| Framework | What it covers | How we design for it |
|---|---|---|
| OWASP LLM01, LLM06, LLM10 | Prompt injection, excessive agency, unbounded consumption. | Injection tests, least-privilege tools, step and cost limits. |
| EU AI Act Art. 14 | Human oversight for high-risk systems. | Approval steps a person can act on, with the context to decide. |
| MAS Guidelines on Artificial Intelligence Risk Management | Closer attention for AI that can act and use tools. | Action logs and approval records for every agent. |
Questions
What operations teams ask.
What can an agent do without approval?
Only read-only actions you list. Anything that writes or moves money waits for a person.
How do you stop a malicious PDF instructing the agent?
Retrieved content is treated as data, tools are limited, and we test with planted attacks before release.
How do you know the agent works?
An evaluation set built from your real tasks, graded on outcome, plus a trace of every step. Every failure in production becomes a new test.
What happens when the model is down?
The application fails safely and tells the user, and work falls back to the manual process.
What we don’t promise
Some claims we won’t make.
- Autonomous agents that move money or make clinical decisions.
- That an agent never makes a mistake. We design so a mistake is caught and can be undone.
Further reading
- Evaluation · 6 min readAnyone who can send you a document can talk to your agent.Most controls treat prompt injection as a bug waiting for a patch. It follows from how these models read, which means the only defence that holds is designing so that a successful injection is not worth anything.
- Evaluation · 5 min readYou can’t unit-test an agent. So how do you know it works?Normal software fails loudly and repeatably. Agents fail quietly, differently each time, and only on the cases you didn’t imagine. Here’s what testing one actually looks like.
- Applications · 5 min readThe hard part of an AI agent isn’t the model. It’s the leash.Every agent demo I’ve built worked because the agent could do anything. Every one that reached production worked because I’d spent most of my time deciding what it wasn’t allowed to do.
One workflow, measured.
Bring a task your team does every day. We’ll tell you what an agent could safely do.