AI Agents Need Boundaries Before They Get Business Access
AI can save time. But when it starts taking action inside a business, someone still needs to decide what it is allowed to do, what it can reach and when a person must take over.
When you first start using AI, you might ask it a few questions and play around with it. Then you may give it a task: write a letter, help fill in a document or give you a starting point for something you are working on.
Once you start down that road, it can be a very long way back. I do not mean that in a negative way. It depends on how you look at it. AI can save you time and help you get more done. But I think you need to stay mindful of how much you rely on it.
For me, AI should do what saves you time. It should not take over the running of your business. If it is going to be part of a system, the human needs to be steering the steering wheel.
Give The Agent A Clear Role, Not The Whole Business
Before an AI agent is allowed to act, decide what task it is there to help with and where its responsibility stops.
You Are Still The Boss
When I work with AI, I do the strategy work. I tell it what I want and how I want things to look. It is no different to being the boss of a team and explaining what you need. AI can make mistakes, just as people can, so I still need to check the work and make the decisions.
There are times when I ask AI for an opinion. If I have reached a dead end in technical work, I may ask what it thinks. That is fine. But if its answer is miles away from my own thinking, I do not bend myself around what it has said. I will consider it when it is aligned with what I am trying to do, and I will make the final call.
That is the first boundary: give an agent a defined job. “Help with our business” is too broad. A clearer task might be “review these new enquiries and suggest a category based on the information provided”. The business can then decide whether the agent is allowed to recommend, update a record or take another action.
What Is It For?
Set a specific purpose and describe what is outside the task.
Who Decides?
Keep business decisions with the person who is accountable for them.
What Gets Checked?
Decide which recommendations or outputs need a human review.
When Does It Stop?
Set a point where the agent must pause and hand the work to a person.
AI can help move the work forward. It should not dictate what the business does.
I have caught myself asking AI, “What do I do?” But that decision should be with me, not the AI. I can ask for an opinion, look at the reasons and use what helps. I should not hand over my judgement just because the answer sounds confident.
Do Not Give An Agent More Access Than Its Job Needs
You choose what a system can see and do. If it does not need access to a business system, it does not need to be connected to it.
Keep The Connection Proportionate
At the moment, whether AI has access to something is down to you and how you build the system. It does not have to have access to anything if you do not want it to. If you place a purpose-built AI inside an operating system, it may be able to understand that system and its workflow. That can make its advice more relevant, but it does not mean it needs permission to change everything.
For example, Prospexto AI is designed around the Prospexto system and its workflow. That context can help it give advice that is aligned with the work being done there. The important design question is still what the AI is permitted to access and what actions it can take.
I might allow AI to help format code or assist with debugging in a controlled environment. That is different from giving an agent broad authority over the main operating environment that handles a whole business. The more important the system, the more carefully its access needs to be considered.
Give It Only The Access Needed
Keep permissions narrow. Separate the ability to read information from the ability to change it, and grant wider access only when there is a clear reason.
Do Not Connect Everything By Default
A useful recommendation does not automatically justify access to customer records, payments, administration or the wider business network.
Separate Networks Where The Work Allows It
I would be cautious about plugging an AI agent directly into the systems that run a whole business. One way to reduce direct exposure is to keep systems on separate networks and control what, if anything, can pass between them.
For example, two routers can use separate connections, including separate SIM-based internet connections, without giving an AI system a direct route to a business network. If there is genuinely no connection or shared device between them, the AI cannot simply invent a bridge into the other network. A SIM router still connects to the internet, though, so that arrangement is not the same as a completely disconnected system. The security depends on what connections and services are actually allowed.
The National Cyber Security Centre explains that network segmentation can restrict access to sensitive systems and help contain an incident. The point is to design and check the boundaries, rather than assume that putting equipment in different rooms has done the job.
If the AI does not need a route into the system, do not give it one.
Protect The Accounts, Data And Backups Around It
A system boundary is only useful if the accounts and information behind it are protected as well.
Security Keys And Strong Sign-In
I like security keys. A strong, phishing-resistant sign-in method can make it harder for somebody to take over an important account using a stolen password. The NCSC recommends FIDO2 multi-factor authentication where appropriate, including security keys or supported device-based credentials.
For very sensitive actions, a business can also require a second person to approve what is being done. That is a separate control from a security key: a key helps prove who is signing in, while a multi-person approval process makes sure one person cannot authorise every critical action alone.
Keep Backups Away From The Main System
I also like the idea of a backup that is separate from the computer or system it is protecting. If ransomware affects the live system, a clean and usable backup can give a business a way to restore its work. The important words are separate, current and tested.
A backup kept connected to the same network or account may be exposed to the same incident. The NCSC recommends protecting backups from unauthorised modification or deletion, storing them separately from primary systems and testing restoration. A manual copy can be useful, but it should not be the only copy: it can become out of date, be damaged or be lost.
There is also a difference between recovering your own system and deleting a copy an attacker may have stolen. A backup can help you restore your files; it cannot guarantee that an attacker has erased information already taken. That is why prevention, access control, response planning and recovery all matter together.
Have a copy you can restore from. Then test that you really can restore it.
Spam and link protection can help reduce the chance that a harmful message leads to a problem. They work alongside secure sign-in, limited permissions, staff awareness and backups. No single control does the whole job.
Test The Agent Before It Touches Live Business Work
Do not begin with full access. Test the job, the permissions and the hand-off in a controlled environment first.
Start Small And Watch What Happens
Before connecting an agent to live systems, test it with a limited set of information and a clearly defined task. See whether it follows the instructions, what it does when information is missing and whether it asks for help when it reaches a decision it should not make.
The NCSC’s guidance on agentic AI says responsibilities should be defined before an agent is connected to real systems or data, and that responsible people need to be able to intervene. I agree with that approach. You should know who owns the agent, what it can do, how to pause it and what happens if the result is wrong.
Testing should also check the boundaries. Does the agent only see the intended information? Can it make changes it was not meant to make? Does it stop before sending a message, changing a record or doing something with a lasting impact? These are questions to test with permission, in a controlled environment.
Define
Set the agent’s task and the decisions that stay with a person.
Isolate
Restrict access and control any route between networks.
Protect
Secure accounts and keep separate, tested backups.
Test
Try the task and permissions in a limited environment.
Review
Monitor, intervene and improve as the system changes.
Do not ask only whether the agent can do the task. Ask whether it can stay within the boundaries you set.
Keep A Human In Control After The Agent Goes Live
Threats and systems change. Keep reviewing what the agent can reach and how it behaves.
Different Threats Need Different Defences
There are different threats a business may need to think about: ransomware, worms, other forms of malware, phishing and more. They work in different ways, so there is no single control that catches everything. Sometimes you can see warning signs or attempts before they cause damage. Security teams may also use decoy systems, sometimes called honeypots, to help detect or study activity. Those tools need to be set up and monitored properly; they do not guarantee that an attacker will be identified or caught.
For an AI agent, monitoring also means understanding what it is doing: which systems it accessed, what information it used, what actions it took and whether it paused for a person when it should. Keep records that help a responsible person review what happened, and have a clear way to suspend the agent if something does not look right.
AI Is Coming Into More Of Our Work. Stay Able To Work Without It.
I think AI could become something people rely on heavily. There is a lot of investment and commercial interest in it, and I do not think it is simply going to disappear. So, in a way, you are better off saddling up and riding the horse. But you still need to be mindful of how dependent you become.
If I had to do the work I use AI for manually again, I could. It would take me longer. Could I code as well? Probably not. Could I grow a business and make money? Yes, I believe I could. That is the balance for me: use AI to save time, but keep your own judgement and knowledge involved.
When I work with AI, I set the strategy and explain what I want. It is like leading a team. The tool can help carry out work, and it can make mistakes, just as people do. I still need to understand what is happening and decide what the business should do next.
Use AI to save time. Keep the human responsible for the direction.
For businesses working out where systems could save time, it helps to understand the real work first. AI-Human Growth Systems’ marketing research is one place to explore how research can inform better business decisions.
Give AI A Role. Keep The Human At The Wheel.
AI can be useful. It can help write a letter, fill in a document, give an opinion or complete a task that saves time. But as soon as an agent is connected to business systems, the business needs to be clear about what it is allowed to do and what remains a human decision.
My approach is simple: do not give an agent too much power. Define its job, limit its access, protect the accounts and backups, test it before it touches live work, and keep a person able to review and intervene. If the system does not need a connection, do not create one just for the sake of it.
Separate networks can reduce direct access, but the real protection depends on the routes, devices, accounts and services in use. A separate SIM router can remove a shared wired connection, but because it still connects to the internet, it is not the same as a fully disconnected network. Be precise about what is connected and who can authorise a connection.
AI can offer an opinion and save time. The person responsible for the business must still make the decisions.
I do not think there is anything wrong with using AI. I use it myself. But I want to know that I can still think, work and make decisions without handing over control. That is why our approach is AI-Human: AI helps with the work, while the human stays responsible for where the business is going.
Further reading: NCSC: Managing the cyber risk of agentic AI, NCSC: Limiting the impact of a compromise, NCSC: Ransomware-resistant backups and NCSC: Recommended types of MFA.