Keeping an Agent Safe in Production

Safety is what earns an agent the right to run without a babysitter.

Defense in layers

• Tool scope is your strongest control: if the agent cannot call a dangerous tool, no clever prompt makes it.
• Approval gates for anything irreversible or outward-facing (sending, spending, deleting).
• Reversible by default — "draft" over "send," "archive" over "delete."

Guard the inputs

Prompt injection hides instructions inside the data your agent reads — a web page, an email, a PDF. Treat all retrieved content as untrusted, and never let it change what tools are allowed.

Watch the right signals

1. Log every tool call with its arguments.
2. Alert on spend, volume, and error spikes.
3. Keep a kill switch you can hit without a deploy.

Make the worst case boring, and you can finally look away.