AI agents: separate interpretation from permission to act

Understanding a request does not authorise every operation

An agent can interpret documents and suggest an action. The company must still define who can execute it, on which data and within which limits. An instruction sent to the model does not replace authorisation checked by the system.

Access must match the task. A status query does not need permission to change the entire record set. An update must receive defined identifiers and fields rather than unrestricted database or server commands.

Check identity, workspace and action on the server

In applications I implemented, authorisation links session, workspace and permission for each action. The server checks access even when the interface hides a button. The audit record identifies the actor, operation and result.

In service integrations, I also implemented signatures that bind the body, message type and time. These signatures check authenticity within protocol conditions. They do not grant business permission or by themselves prevent a replay within the accepted time window.

Check output before producing an effect

Generated output must pass a contract for types, fields and limits. In a speech analysis flow I implemented, quoted excerpts must appear in the attributed speech. The check rejects evidence without a match, but it does not prove the interpretation is true.

After this check, the action must still verify authority and current conditions. Also define quantity, cost and retry limits. For an effect that is difficult to reverse, the flow must provide the required review before execution.

Deploy agents with bounded capabilities

Consulting can map actions, connect systems and define controls outside the model. The scope can include permissions, validation, audit and failure recovery. The proposal states what automation executes and what remains subject to the company's decision.