AI securitySeptember 13, 2026

How do you control an AI agent’s access and actions?

Prepare an authorization worksheet for your AI agent: task, data, permitted actions, human decisions and scenarios to check before a trial.

Introduction

To control an AI agent, connect each task to specific data, authorized actions and a responsible person. Restrictions need enforcement in the tools and systems the agent uses, rather than appearing only in model instructions. Start with one concrete business action so you can decide what may be tried, approved or prohibited.

Separate accessible information from possible effects

A project can appear narrow because its objective fits into one sentence. Yet “prepare a case follow-up” might involve reading documents, changing a status and sending a message. Write these operations separately. Your team can then ask a specific technical question about each, instead of assuming that a general description establishes its boundaries.

OWASP describes excessive agency as a risk involving unnecessary functions, permissions or autonomy. Its guidance recommends limiting capabilities and enforcing authorization in the relevant systems. That technical principle does not, by itself, determine the business decisions appropriate for your organization.

LLM06:2025 Excessive Agency

AI Agent Security Cheat Sheet

Specialists constraining an AI agent workflow with access boundaries and human approvals — An AI agent should follow an explicit authorization path, with technical boundaries and human approval for sensitive actions.

Prepare a worksheet for one action

The following original planning tool can support a discussion with your provider or IT team. Choose an action described by a verb and an object, such as “suggest a status for this case.” If your description is “manage cases,” break down the work further. The narrower description makes the intended outcome easier to discuss.

The worksheet does not need to be perfect at the first meeting. Its value comes from the questions it exposes. An unanswered field can become a request for a demonstration, a trial to prepare or a decision to defer until the relevant information is available.

Expected result: what specific work will be presented to the user?
Necessary information: which records and fields are relevant to this task?
Intended effect: is this a suggestion, a modification or a communication?
Decision: who evaluates the result, and under what circumstances?
Verification: which case can demonstrate an expected refusal or permitted action?
Follow-up: who handles an anomaly, and what information will they receive?

Fictional example: preparing supplier request follow-ups

A fictional business wants to help its purchasing team follow up on incomplete requests. For the first trial, it chooses an entirely synthetic set of records. The intended result is a list of missing documents and a draft message. This is neither an actual customer system nor an outcome observed at Loupe.

The team prepares three cases: a complete record, a record with a missing document and two requests with similar names. It writes the expected result for each before the trial. In this scenario, ambiguous names should lead to a clarification request rather than a silent choice of supplier.

A second workshop considers the possible move from drafting a message to sending it. The business owner must then decide what needs review: the supplier, address, documents mentioned and final wording. This new step receives its own worksheet. A successful first trial is not used to approve a different capability automatically.

Request evidence for each decision

OWASP’s agent security cheat sheet also addresses human controls and security testing. For your workshop, turn worksheet decisions into expected observations. “A person can intervene” is too vague: demonstrate when that person intervenes and what happens when they decline an action.

In our fictional example, prepare a result sheet with four columns: test record, expected result, observed result and next-step decision. Ask the trial owner to describe differences in language the purchasing team can understand. A technical report can supplement this sheet without replacing the business decision. Keep the original expectation visible when reviewing what actually happened.

LLM06:2025 Excessive Agency

AI Agent Security Cheat Sheet

Decide the next step and its boundaries

After the workshop, assign remaining questions to the appropriate owner: business needs, technical access, provider conditions or personal information handling. Each question should have an observable next action, such as obtaining a written answer or preparing another trial case. An unresolved question list should not become a general authorization to proceed.

Loupe Technologies proposes scoping for AI use and agent security. Bring this worksheet to a discussion about the task, information and decisions you are considering. Building an agent, conducting technical tests and operating the system require a separate scope to be agreed. The worksheet helps prepare that conversation; it does not establish that a system is ready for use.

Frequently asked questions

Is an instruction in the prompt enough to restrict an agent?

No. OWASP recommends authorization checks in the systems executing actions. A prompt can express the intended rule, but it does not replace that technical control.

Is human approval enough to authorize a launch?

It is not sufficient to reach that conclusion by itself. Your decision should address the operation actually examined, outstanding issues and responsibilities. In the proposed worksheet, record what the reviewer sees and what their choice authorizes.

What should we prepare for a first conversation with Loupe?

Describe one task, the tools under consideration and a concrete result. Do not send confidential records to illustrate the need: a synthetic example is enough to begin. Scoping will establish what information is needed for subsequent work.