Agent risk is not only a model-safety question. It is an access-governance question: what the agent can know, reach, decide, and do.
Autonomy changes the control problem
A conventional assistant returns content to a person. An agent can interpret a goal, select tools, retrieve context, and take actions across connected systems. Each capability may be reasonable alone; their combination can create a large and poorly understood blast radius.
Governance should begin with authority, not the label “agent.” Examine the actual workflow and identify where software can initiate consequential change without a person reviewing the specific action.
A practical authority map
Identity
Determine whether the agent uses a dedicated machine identity, a shared credential, or delegated user access. Dedicated identities improve attribution and support narrow permissions. Avoid assuming that user delegation is automatically least privilege.
Tools and actions
List every connected tool and distinguish read, draft, recommend, create, modify, approve, send, delete, and execute capabilities. A connector name alone does not describe its authority.
Context and data
Map system instructions, retrieved knowledge, conversation history, secrets, and tool output. Consider whether untrusted content can influence the agent’s reasoning or instructions.
Approval boundaries
Place meaningful approval before an irreversible or material action, not after the workflow has already created the consequence. Approvers need enough context to understand what will occur.
Observability and containment
Logs should connect goals, tool calls, identities, decisions, approvals, and outcomes. Define rate, scope, transaction, and time boundaries; provide a reliable way to stop the agent and revoke access.
Review the combination
Agent controls should be evaluated as a system. A modest model with excessive permissions can be dangerous; strong identity controls can still fail when untrusted content steers tool use. The review must follow the complete path from instruction to action.