AI Agent Safety Checklist
An AI agent may be able to use tools, access systems and take actions rather than merely provide advice. Use this checklist before connecting an agent to business data, production systems, external communications or administrative functions.
An AI agent may be able to use tools, access systems and take actions rather than merely provide advice. Use this checklist before connecting an agent to business data, production systems, external communications or administrative functions.
Before you begin
A supplier’s safety claims do not replace access control. Evaluate what the agent can actually reach, not what the vendor says it will do. Infrastructure limits — what the agent cannot access — are more reliable than behavioural instructions alone.
Step 1 — Identify the agent
- □ Agent name
- □ Supplier
- □ Model and model version
- □ Business purpose
- □ Business owner
- □ Technical owner
- □ Test or production environment
- □ Users
- □ Renewal or review date
Step 2 — List its tools
Can it:
- □ Browse websites
- □ Read email
- □ Send email
- □ Read files
- □ Edit files
- □ Delete files
- □ Run code
- □ Access databases
- □ Use cloud administration
- □ Create accounts
- □ Change permissions
- □ Make payments
- □ Contact customers
- □ Upload information externally
- □ Install software
Mark each tool as: required · optional · excessive · prohibited.
Step 3 — Review data access
- □ Only required data is accessible
- □ Customer data is separated
- □ Sensitive data is minimised
- □ Test data is synthetic where possible
- □ Production data is not used unnecessarily
- □ Retention is defined
- □ Logs do not expose confidential data
- □ The supplier’s use of data is understood
Step 4 — Review identity and permissions
- □ Dedicated identity (not shared with other agents or services)
- □ No shared administrator account
- □ Read-only by default
- □ Scoped permissions
- □ Short-lived credentials
- □ Secrets stored securely
- □ No credentials in prompts
- □ Privilege escalation requires approval
- □ Permissions can be revoked quickly
- □ Access is reviewed regularly
Step 5 — Review network access
- □ No unrestricted internet unless required
- □ Approved destinations documented
- □ Egress filtering enabled
- □ Internal networks restricted
- □ Test and production separated
- □ External uploads controlled
- □ New destinations monitored
- □ Bandwidth or transaction limits defined
Step 6 — Add human approval
Require approval before:
- □ Sending external messages
- □ Deleting data
- □ Changing permissions
- □ Deploying code
- □ Making payments
- □ Creating accounts
- □ Exporting information
- □ Contacting customers
- □ Changing security controls
- □ Performing irreversible actions
Step 7 — Enable monitoring
- □ Prompts logged
- □ Tool calls logged
- □ Commands logged
- □ Data access logged
- □ External destinations logged
- □ Approvals logged
- □ Rejected actions logged
- □ Costs monitored
- □ Unusual behaviour alerted
- □ Logs protected from modification
Step 8 — Test the boundaries
- □ Prompt-injection testing
- □ Unauthorised tool-use testing
- □ Data-exfiltration testing
- □ Network-boundary testing
- □ Privilege-escalation testing
- □ Unsafe-retry testing
- □ Log-tampering testing
- □ Shutdown testing
- □ Model-update regression testing
Step 9 — Test the stop process
- □ Agent can be paused
- □ Credentials can be revoked
- □ Sessions can be terminated
- □ Network access can be blocked
- □ Workload can be shut down
- □ Changes can be rolled back
- □ Responsible contacts are known
- □ Incident procedure is documented
Step 10 — Decide the autonomy level
| Level | Description | When to use |
|---|---|---|
| Advisory only | Agent recommends; a person decides and acts | All high-risk or unfamiliar contexts |
| Draft for human action | Agent prepares the action; a person executes it | Where human judgement is required before execution |
| Human approval before execution | Agent proposes; explicit approval required before it acts | High-impact or irreversible actions |
| Limited autonomous execution | Agent acts within narrow, reversible boundaries | Routine, low-risk, well-tested tasks |
| Broad autonomous execution | Agent performs significant actions with limited approval | Only where extensive testing and monitoring are in place |
The autonomy principle
Start at the lowest level that still delivers the required business benefit.
Step 11 — Approval decision
- □ Approved for test
- □ Approved with restrictions
- □ Approved for limited production
- □ Further assessment required
- □ Not approved
Record: approver · date · restrictions · action owner · next review date.
Want the full explanation?
Read our Technology Intelligence article for a plain-English explanation of what happened when an AI agent reportedly operated beyond its test environment, what it means for AI governance and what controls businesses should put in place.
Plain-English Takeaway
An AI agent should receive only the tools, data and permissions required for its task. Keep test and production environments separate, require human approval for high-impact actions, log everything the agent does and maintain a tested way to stop it quickly.
Downloadable guide
Download the AI Agent Safety Checklist
A printable checklist for reviewing an AI agent’s tools, permissions, network access, approvals, monitoring and emergency controls.
Download PDFFree download. No email address required.
Want the full business explanation?
The Technology Intelligence article covers why this matters, where it helps and what to watch out for.
Read the full Technology Intelligence articleRelated Knowledge Centre resources
Questions to Ask Before Buying an AI Tool
The practical questions that separate useful AI tools from expensive experiments.
View guideSafe Use of Generative AI at Work
Simple rules to help staff use AI tools without exposing business or customer data.
View guideAI Policy Starter Guide
The starting points for a sensible, plain-English AI policy for a small business.
View guide