Give the agent one job at a time
Start with a narrow task and a clear definition of success. A workflow that drafts a reply for review is easier to reason about than an open-ended agent that can send messages, change records and spend money.
Limit data and permissions
Connect only the documents and tools needed for that task. Use separate credentials with limited access. Keep secrets out of prompts and code. Treat external content as untrusted, because a document or web page can contain instructions designed to mislead an agent.
Make a person part of important decisions
Require approval before the agent sends a commitment, changes sensitive data, grants access or triggers a payment. Show what it plans to do and why. A human approval step is useful only if the reviewer has enough context to make a real decision.
Test the uncomfortable cases
Test missing information, contradictory sources, malicious instructions, unexpected tool errors and requests outside the agent's job. Define when it should stop, explain uncertainty and hand off. Review a sample of normal results too; quiet errors can be harder to spot than obvious failures.
Keep an audit trail and an exit
Record the inputs, outputs and actions needed to understand a decision, while avoiding unnecessary personal data in logs. Track changes to prompts, permissions and connected tools. Know how to disable the agent and return the process to a human.