Give agents a job description.
An agent is closer to a new employee than a tool. Define its job, its limits and who signs off, before it touches anything live.
Scope
What It May Do
One clear job, in named systems. Everything else is out of bounds.
Limits
What It May Not
Spending caps, data it can't touch, and systems it can read but not change.
Approvals
Who Signs Off
Which actions need a person first: payments, customer messages, deletions.
Record
What It Did
Every action logged, with an owner who reviews the log.
Narrow job. Clear limits.