I need an AI agent to take actions without risking our systems

What it is

Once an agent can act (send, deploy, refund, delete), the question changes from “is the answer good?” to “what is the worst it could do?”.

How it works

Simon Willison frames agent design as permissions design. His coding example is a key that works in staging but not in production. The same pattern applies to business tools:

1. Scoped credentials: a separate account or key for the agent, with the minimum access it needs.
2. A safe sandbox: a test environment, a draft folder or a sandbox ad account.
3. An automatic check: tests, validation rules or a reviewer step the agent must pass.
4. A hard boundary: actions that always need a human, such as payments, external sends and deletions. Some vendors now build this in: Stripe’s MCP server requires human confirmation before refunds and outbound payments, and from December 2026 it stops accepting full-access secret keys, so autonomous clients need OAuth or a scoped agent API key.

Check for the lethal trifecta. Simon Willison’s term covers one agent session that can read private data, read untrusted content and send data out. With all three, a hidden instruction in an email or web page can leak your data, so remove at least one leg from every workflow. See the lethal trifecta.

Spending authority. Agents that can buy need a budget cap, an allow-list of vendors and human approval above a set amount. See agentic commerce.

Defaults in common agent platforms (checked 2026-10-16)

• Cursor: sensitive actions need your approval by default. Terminal commands ask first; the agent can edit workspace files without asking, except configuration files.
• OpenAI Codex: locally, an OS-enforced sandbox limits the agent (typically to the current workspace), network access is off by default, and an approval policy decides when it must stop and ask.
• Claude Code: recent versions start interactive terminal and VS Code sessions in auto mode, where a classifier model reviews actions such as shell commands and network requests instead of you. Manual mode asks before most edits, commands and network access.
• Google Antigravity: under the Default preset, terminal commands run without prompting inside a sandbox limited to your workspace and temp folders with no network; anything outside the sandbox, web browsing and MCP tool calls ask first.
• Grok Bot: what needs approval depends on the tool, the risk and your Auto-review rules; you add narrow “Ask first” rules for sending, publishing, deleting, purchasing or changing production systems.

Defaults change between versions and plans, so confirm them in each vendor’s docs before you widen access.

Benefits

• Mistakes stay small and reversible.
• Faster trust. Clear limits make it easier to widen access over time.

Limits and risks

• Sandboxes don’t stop leaks. An agent can still expose whatever it can read, so limit read access too.
• Connectors inherit your access. An MCP connection made with an admin account acts as that admin.