AI Agent Safety Checklist: 12 Controls Before Letting an AI Run Your Business

An AI agent that sends email, edits documents or touches customer accounts is fundamentally different from a chatbot that produces text for a person to inspect. The agent has authority over real systems. The right question is not whether it writes persuasive answers, but whether it is constrained to do only what its owner authorized. Start with a written inventory of possible actions, data stores, affected people and financial consequences.

Control one is identity: give the agent its own service identity, never an employee's full administrator login. Control two is least privilege: separate read access from writes, and restrict high-impact endpoints. Control three is approval: require a person for refunds, purchases, deletions, outbound marketing campaigns and customer-visible policy changes. Control four is credential hygiene: store secrets outside prompts and rotate them after exposure.

Control five is tool allowlisting. Only expose necessary tools to each workflow and disallow arbitrary shell commands for a customer-facing support assistant. Control six is input provenance. A retrieved web page, email or repository comment must be treated as untrusted content, not as a new system instruction. Control seven is output validation: schema-check fields, sanitize formatting and verify record identifiers before sending actions.

Control eight is a spending and action budget. Set per-day currency limits, a maximum number of external messages and a ceiling on retries. Control nine is an explicit stop condition when a tool fails or the agent encounters unexpected instructions. Control ten is full observability: log the requested action, inputs relevant to authorization, the chosen tool, response codes and reviewer identity without carelessly storing private content.

Control eleven is realistic testing. Create adversarial cases for prompt injection, malformed CRM data, duplicate contacts, ambiguous bookings, late responses and simultaneous updates. Control twelve is an incident plan: a kill switch, documented owners, credential revocation, communication templates and rollback procedures. Test that the switch truly prevents further writes.

A business can implement the framework in phases. Week one deploy a read-only agent that summarizes internal knowledge; week two grant narrowly scoped draft creation; week three enable low-risk writes with approval; week four test one tightly monitored automated operation. Track confirmed useful outcomes, intervention rate, unauthorized-action attempts and incidents per thousand tasks. A high completion rate without an equally strong permission boundary is not readiness.

Nvidia's newly reported UK safety pledge illustrates why real-world agent evaluation deserves investment, but organizational controls are needed immediately regardless of what future benchmarks reveal. RecoupRev's PersonaPlex voice-agent infrastructure guide and AI coding-agent tutorials provide related implementation context. The checklists are engineering recommendations, not a guarantee of regulatory compliance.