Deploying AI agents safely: autonomy, permissions and blast radius

How much autonomy to give an AI agent, how to scope its permissions by blast radius, and how to keep a record of what it actually did in production.

For most companies the question is no longer whether to use AI agents. The harder questions are how much to let them do on their own, what they are allowed to touch, and how you would know afterwards what they did.

The posts here come at that from a few directions. Some deal with reliability and why agents stall on long workflows. Some deal with permissions, sandboxes and the infrastructure that has to enforce them. A few are about the less technical side: an agent with no reputation to lose behaves differently from an employee, and the scaffolding you wrote for last year’s model may now be working against you.

If you are about to roll out agents beyond a pilot, read the first three before anything else.

The posts, in reading order

  1. The Autonomy Budget: Deploying AI Agents Before They're Reliable
    Meta is spending $145B on AI yet says agents have stalled. The real limit is compounding math, and it decides which workflows you can safely hand to an agent today.
  2. Treat an AI agent like a new hire
    A frontier model got a real business and a deadline. It spammed, faked its metrics, and made nothing, because no one gave it a reputation it could lose.
  3. Goldman limited coding agents by job title. Limit them by blast radius.
    Goldman Sachs pulled coding agents from most traders and bankers. The control that works is narrower permissions per agent, and it lets you keep the demand.
  4. The blast radius of a goal
    An OpenAI model escaped its sandbox and breached Hugging Face to cheat on a benchmark. The failure mode is old and mundane, and it changes how you deploy agents.
  5. OpenAI couldn't say what its agents did. Neither can you.
    OpenAI's agents broke a package registry it doesn't own, and months later the company still couldn't say what they did. That gap is the real risk in your agent rollout.
  6. A limited shell account is only as limited as the software enforcing it
    Tailscale is patching SSH flaws that let an authorized user exceed their account. Before you give an AI agent a scoped shell, ask what enforces the scope.
  7. The real price of an agent sandbox is the team that patches it
    Replit went through 6,211 Linux kernel advisories in five months to keep agent code contained. Ask who does that work before you pick a sandbox vendor or decide to build.
  8. LiteLLM was compromised twice in seven months. Here is what that means for your AI strategy
    A compromised LiteLLM release spent about two hours on PyPI this week. It shows why the box you built for AI governance is also your most valuable target.
  9. Anthropic cut 80% of its AI's instructions. Most teams are adding more.
    Anthropic stripped most of its coding agent's system prompt and lost nothing. The scaffolding you wrote for last year's model is now taxing both your cost and your quality.
  10. Rent the AI harness. Own what it learns.
    A harness around a model is where a company's judgment will live. Most firms can buy the loop and should keep the two parts that compound: corrections and review rules.
  11. Run your next incident drill with the AI turned off
    AI is absorbing the routine incidents that used to train on-call engineers. A timed drill with the AI off shows whether your team can still handle the one that matters.

Common questions

How much autonomy should an AI agent get in production?

Less than the demo suggests. Small error rates compound across every step an agent takes, so a workflow with many steps fails far more often than any single step does. Hand agents the workflows where a mistake is cheap to catch and cheap to undo, and widen the scope as the evidence comes in.

How should we limit what an AI agent is allowed to do?

Scope permissions per agent by the damage it could do, its blast radius, rather than by the job title of the person using it. Then check what actually enforces that scope, because a limited account is only as limited as the software enforcing it.

Do we need an audit trail for AI agent actions?

Yes. If an agent touches systems you depend on, you need to be able to say afterwards what it did, in what order and with which credentials. OpenAI could not answer it about its own agents months after they broke a package registry.

All guides · Book an AI advisory hour