Rules for Operating Agents Internally
If you bring agents into work, operating rules prevent incidents more than technology. Unlike personal use, an organization's blast radius is wide.
Minimum Rules
- Permitted uses: document what may/may not be used for
- Least privilege: agent accounts, minimum necessary access
- Approval gates: humans approve external sending, payments, deletion, production changes
- Data boundary: classify info OK to input (confidential prohibited/approved tools)
- Logs and audit: records that trace what was done
- Stop procedure: an owner and procedure to stop/revert on runaway
How to Adopt
- Start with small, low-risk work and expand scope with a track record
- Always clarify the person in charge and the owner (no irresponsible abandonment)
- Inspect malfunctions/deviations in periodic reviews
Chapter Summary
Agents' value is large, but "least privilege, human approval, logs, stop procedure"—these 4 are the lifeline of organizational adoption. Making rules at the same time as technical adoption is the iron rule.
