Security
Guardrails first: designing agents your security team will approve
Spend limits, scoped permissions and audit logs are not extras. They are the reason agents get approved at all.
Lena Ortiz
Every agent conversation with a security team starts the same way: what can it touch, and how do we stop it? Answer those two questions well and the rest of the review moves fast.
Scope access per tool
Give each agent the narrowest permission that still lets it finish the job. Read access is usually enough for research. Write access should come with a threshold.
Log everything, in plain language
An audit log only helps if a person can read it. Every step should say what the agent did, why, and which data it used.
Back to all posts