Your AI assistant needs a job description and a permission boundary

An assistant that can read a document is different from one that can edit a customer record or send a message. The relevant question is not whether the product is called an agent. It is what the connected account permits it to do.

OWASP identifies excessive functionality, permissions, and autonomy as common causes of excessive-agency risk and recommends restricting each to the minimum necessary (OWASP Excessive Agency). The examples below adapt that guidance to proposed agency workflows; they are not claims about any specific application.

Write down whether the system may read, draft, write, send, or delete. For each capability, identify the permitted records and the responsible user. “Connected to email” is not specific enough if the task only needs to summarize one folder.

A submission-triage pilot might begin with read access to a controlled document set and no permission to change production records. A follow-up assistant might prepare a draft without permission to send it. These narrower designs make the action boundary easier to inspect.

An instruction saying “do not send without approval” is not the same as an enforced permission. OWASP recommends downstream authorization checks rather than relying on the language model to decide whether an action is allowed (OWASP Excessive Agency).

Ask the vendor to show what happens when an unapproved action is requested. Determine whether the restriction exists in account permissions, application code, or only instructions supplied to the model. Ask what the audit log records.

For a proposed external-message workflow, show the recipient, attachments, complete message, and exact action before approval. For a record update, show the existing value and proposed replacement. An approval of one operation should not silently authorize a chain of additional consequential actions.

The point is to make authorization understandable. If the reviewer cannot tell what will happen next, the control needs redesign.

Identify who can disable the connection, revoke access, and return the team to manual work. Keep an inventory of the connected identity and its permissions, and review it when the task or tool changes.

OWASP notes that logging, monitoring, and rate limits can help identify or limit damage but do not prevent excessive agency by themselves (OWASP Excessive Agency). Do not present an activity log as a substitute for a permission boundary.

Next: Read why an incoming document can contain instructions and record the approved actions in the AI use register.