Permission to Act: a practical guide to securing AI agents
Prompt injection cannot yet be reliably detected or trained away. How to decide what each agent may read, reach and do, so a successful injection cannot cause real harm.
About this guide
AI agents now send email, move money, change records and run code, and they read text they cannot verify. Prompt injection hides instructions in that text, and the research is clear that it cannot yet be reliably detected or trained away: adaptive attackers bypassed 12 published defenses, most more than 90% of the time, and every one of 13 frontier models was breached in a public competition.
This guide shows operators how to make agents safe anyway, by deciding what each one may read, reach and do in a single session, giving it its own identity, and putting consequential actions behind rules and people.
What it covers
- The problem in numbers. Why agents act on text they cannot verify, and why better models alone will not close the gap.
- The Agent Permission Envelope. Five boundaries for describing any agent: inputs, reach, actions, identity and oversight.
- Four control tiers. How the lethal trifecta and the reversibility of an agent's worst action set the controls it needs.
- Seven steps. From an agent register to a tested kill switch, each with an owner and an output.
- Three worked examples. An accounts-payable agent, a sales research agent and a coding agent with MCP tools.
- A permission card and a checklist. One card per agent, and 13 checks before an agent goes live.
- Pages
- 24
- Reading time
- About 23 minutes
- References
- 25
- Published
- November 2026
