Knowledge Centre
AI GuidesChecklist and Guide

AI Agent Safety Checklist

12 minutes to completeEvergreen guide — kept up to date

An AI agent may be able to use tools, access systems and take actions rather than merely provide advice. Use this checklist before connecting an agent to business data, production systems, external communications or administrative functions.

An AI agent may be able to use tools, access systems and take actions rather than merely provide advice. Use this checklist before connecting an agent to business data, production systems, external communications or administrative functions.

Before you begin

A supplier’s safety claims do not replace access control. Evaluate what the agent can actually reach, not what the vendor says it will do. Infrastructure limits — what the agent cannot access — are more reliable than behavioural instructions alone.

Step 1 — Identify the agent

  • □ Agent name
  • □ Supplier
  • □ Model and model version
  • □ Business purpose
  • □ Business owner
  • □ Technical owner
  • □ Test or production environment
  • □ Users
  • □ Renewal or review date

Step 2 — List its tools

Can it:

  • □ Browse websites
  • □ Read email
  • □ Send email
  • □ Read files
  • □ Edit files
  • □ Delete files
  • □ Run code
  • □ Access databases
  • □ Use cloud administration
  • □ Create accounts
  • □ Change permissions
  • □ Make payments
  • □ Contact customers
  • □ Upload information externally
  • □ Install software

Mark each tool as: required · optional · excessive · prohibited.

Step 3 — Review data access

  • □ Only required data is accessible
  • □ Customer data is separated
  • □ Sensitive data is minimised
  • □ Test data is synthetic where possible
  • □ Production data is not used unnecessarily
  • □ Retention is defined
  • □ Logs do not expose confidential data
  • □ The supplier’s use of data is understood

Step 4 — Review identity and permissions

  • □ Dedicated identity (not shared with other agents or services)
  • □ No shared administrator account
  • □ Read-only by default
  • □ Scoped permissions
  • □ Short-lived credentials
  • □ Secrets stored securely
  • □ No credentials in prompts
  • □ Privilege escalation requires approval
  • □ Permissions can be revoked quickly
  • □ Access is reviewed regularly

Step 5 — Review network access

  • □ No unrestricted internet unless required
  • □ Approved destinations documented
  • □ Egress filtering enabled
  • □ Internal networks restricted
  • □ Test and production separated
  • □ External uploads controlled
  • □ New destinations monitored
  • □ Bandwidth or transaction limits defined

Step 6 — Add human approval

Require approval before:

  • □ Sending external messages
  • □ Deleting data
  • □ Changing permissions
  • □ Deploying code
  • □ Making payments
  • □ Creating accounts
  • □ Exporting information
  • □ Contacting customers
  • □ Changing security controls
  • □ Performing irreversible actions

Step 7 — Enable monitoring

  • □ Prompts logged
  • □ Tool calls logged
  • □ Commands logged
  • □ Data access logged
  • □ External destinations logged
  • □ Approvals logged
  • □ Rejected actions logged
  • □ Costs monitored
  • □ Unusual behaviour alerted
  • □ Logs protected from modification

Step 8 — Test the boundaries

  • □ Prompt-injection testing
  • □ Unauthorised tool-use testing
  • □ Data-exfiltration testing
  • □ Network-boundary testing
  • □ Privilege-escalation testing
  • □ Unsafe-retry testing
  • □ Log-tampering testing
  • □ Shutdown testing
  • □ Model-update regression testing

Step 9 — Test the stop process

  • □ Agent can be paused
  • □ Credentials can be revoked
  • □ Sessions can be terminated
  • □ Network access can be blocked
  • □ Workload can be shut down
  • □ Changes can be rolled back
  • □ Responsible contacts are known
  • □ Incident procedure is documented

Step 10 — Decide the autonomy level

LevelDescriptionWhen to use
Advisory onlyAgent recommends; a person decides and actsAll high-risk or unfamiliar contexts
Draft for human actionAgent prepares the action; a person executes itWhere human judgement is required before execution
Human approval before executionAgent proposes; explicit approval required before it actsHigh-impact or irreversible actions
Limited autonomous executionAgent acts within narrow, reversible boundariesRoutine, low-risk, well-tested tasks
Broad autonomous executionAgent performs significant actions with limited approvalOnly where extensive testing and monitoring are in place

The autonomy principle

Start at the lowest level that still delivers the required business benefit.

Step 11 — Approval decision

  • □ Approved for test
  • □ Approved with restrictions
  • □ Approved for limited production
  • □ Further assessment required
  • □ Not approved

Record: approver · date · restrictions · action owner · next review date.

Want the full explanation?

Read our Technology Intelligence article for a plain-English explanation of what happened when an AI agent reportedly operated beyond its test environment, what it means for AI governance and what controls businesses should put in place.

Did an AI Really Escape and Launch a Cyberattack?

Plain-English Takeaway

An AI agent should receive only the tools, data and permissions required for its task. Keep test and production environments separate, require human approval for high-impact actions, log everything the agent does and maintain a tested way to stop it quickly.

Downloadable guide

Download the AI Agent Safety Checklist

A printable checklist for reviewing an AI agent’s tools, permissions, network access, approvals, monitoring and emergency controls.

Download PDF

Free download. No email address required.

Still unsure what applies to your business?

Ask the IT Club Advisor about Microsoft 365, browsers, cyber security, productivity or any everyday technology problem.

Ask Your IT Question

Free to ask. No credit card. No sales pressure. Fair usage applies.