Before giving an AI agent production access, what security controls are you actually using?

AI agents become a very different security problem once they can read data, call tools, modify records, send emails, trigger workflows, or interact with production systems.

A chatbot giving a wrong answer is one thing.

An agent making the wrong API call with legitimate permissions is another.

I've been looking at this from a practical production-readiness perspective, and I think these are the areas teams should review before increasing an agent's autonomy:

1. Unique identity
Every production agent should have its own identity, credentials, and accountable owner. Shared service accounts make investigation much harder.

2. Least privilege
Don't give an agent broad access just because it might need it later. Separate read, write, and destructive permissions wherever possible.

3. Clearly defined task boundaries
An agent built to summarize emails probably doesn't need permission to forward them, delete them, or modify other systems.

4. Approval for high-impact actions
Payments, refunds, deletions, permission changes, bulk updates, and external communications should generally have an additional approval or policy control.

5. Restricted data and tool access
Treat emails, documents, tickets, webpages, and retrieved content as potentially untrusted. The agent should only be able to access the tools and data required for its task.

6. Isolation
Ask: If this agent is manipulated, how much damage can it cause? Sandboxing, network restrictions, and rate limits can reduce the blast radius.

7. Monitoring
Logging infrastructure uptime isn't enough. You need visibility into what the agent actually did—especially its tool calls and meaningful actions.

8. Incident response
Have a kill switch and recovery process before production. Don't design your emergency procedure during the emergency.

One thing I think teams sometimes underestimate is prompt injection.

The problem isn't necessarily that an attacker gets the model to "say something bad." The bigger concern is that untrusted content can influence the agent into using a legitimate tool in an unintended way.