An AI agent can answer a question correctly and still take an action it should not have been able to take. It may read another customer\u2019s record, issue an unapproved discount, or send a message before anyone reviews it. The problem is often described as the agent \u201cignoring permissions,\u201d but the more useful question is whether the surrounding system actually enforced the boundary.<\/p>\r\n\r\n\r\n\r\n
A prompt can tell an agent what it is supposed to do. It is not an access-control mechanism. The application, connected tools, identity provider, and data layer must decide what each request is authorized to access or change. The Canadian Centre for Cyber Security\u2019s guidance on careful adoption of agentic AI<\/a> emphasizes least privilege, identity, controlled tool use, and ongoing review. Those principles apply whether the agent is customer-facing or used internally.<\/p>\r\n\r\n\r\n\r\n This guide shows how to map an agent\u2019s job to its data and actions, enforce permissions outside the model, decide when a person should approve a request, and test the boundary before deployment. The right controls depend on the task, the systems involved, and the potential impact of a mistake.<\/p>\r\n\r\n\r\n\r\n