Control starts before the first execution.
A general instruction to work carefully is insufficient. Specify the task, which information the agent may read and which actions are prohibited. Enforce these boundaries in the connected systems as well.
Separate reading, preparing and executing. An agent can draft a response without permission to send it. It can flag an invoice discrepancy without permission to change bank details or initiate payment.
Sources must support the answer.
Name approved sources and their owners. An HR answer should refer to a current policy and include the relevant source. Conflicting or missing details should lead to clarification or a handover.
Displaying a source does not prove an answer is correct. Test whether the source supports the claim and whether that user is permitted to see the information.
Approvals need an understandable basis.
Show reviewers the relevant details: what was detected, what would change and what remains unclear. A green status alone is insufficient. The proposal must be assessable against the original information.
Define what happens when approval is delayed or refused. Silence must not quietly become approval. For sensitive changes, identify who may decide and how the decision is recorded.
Test what can go wrong.
Include missing details, outdated sources, conflicting data, insufficient permissions and unavailable systems alongside normal cases. Repeating an action also needs attention: a retry should not silently create duplicate records.
Documents and messages may contain text asking the agent to take unrelated actions. This content is input data, not authorised instructions. Test such cases and restrict available actions independently of document content.
Define when the workflow stops, when it may retry and when a person takes over. A clear error message and a recovery path are part of the outcome.
Keep quality and ownership visible in operation.
Monitor output quality, rework, stopped cases and human handovers. Availability alone is insufficient: a service can be running while producing unsuitable answers.
When sources, systems or models change, rerun the affected test cases. Assign ownership for content, technical support and approvals. Controlled operation reduces risk; it does not promise that AI will never make mistakes.