AI agents are increasingly able to take actions, not just answer questions. They can raise purchase orders, update customer records, issue refunds or schedule work. This is where much of the potential value lies, and also much of the risk.
A common early pattern is to give an agent broad access to tools and data and rely on instructions to keep it on track. In an enterprise setting, that is not a sufficient control.
What a controlled interface defines
A controlled interface specifies what information an agent or system may receive, in what format, from which source, and with what limits. It also specifies which actions are permitted, under what conditions, and which require a person to approve.
In practice this looks familiar to anyone who has designed enterprise integrations: defined inputs and outputs, validation, rate and value limits, logging and error handling. What is new is the need to apply it consistently to components that can interpret instructions flexibly.
Least privilege for people, systems and agents
Authorisation policies should treat agents as principals in their own right. A support agent may need to know whether an invoice is overdue, but not the customer's full payment history. A procurement agent may draft a purchase order but not approve one above a delegated limit.
Writing these permissions down before go-live forces useful conversations about decision rights, segregation of duties and accountability, and makes later audits far simpler.
Human oversight is a design choice
Human review should not be an afterthought added when something goes wrong. Approval points, escalation routes and accountable owners belong in the workflow design, especially for decisions that affect customers, money or compliance.
Agents designed this way can still be fast and useful. The difference is that the organisation knows what they can do, can see what they did, and can stop them when it needs to.