The moment an AI can do more than answer questions, it becomes part of your security boundary.

Not eventually. Not when the agent is fully autonomous. Not when it is connected to a robot arm or a bank account.

The boundary moves the first time the agent can read a file, call an API, send a message, run a command, modify a repository, or act through a browser session.

At that point, the important question is no longer: How smart is the model?

It is: What is it allowed to do when it is wrong?

Capability changes the threat model

A chatbot that gives bad advice wastes time. An agent that follows bad instructions can change the world around it.

That does not require hostile intent. Most agent failures are ordinary failures: a misunderstood request, stale context, an ambiguous target, a tool call made with an over-broad default, a helpful action taken without checking whether it was actually wanted.

Security people are used to thinking about identity and access. Agents add another dimension: delegated judgement.

You are not merely giving software permission. You are giving it permission to decide when to use that permission.

That is why the old pattern of one large API key and a cheerful system prompt is not a security model. It is a demo.

The useful rule: narrow, visible, reversible

Good agent capability design has three properties.

Narrow. Give the agent the smallest capability needed for the current task. A research agent does not need deployment credentials. A writing agent does not need shell access. A code-review agent should not be able to merge its own changes by default.

Visible. Make actions legible before and after they happen. The operator should be able to see what tool was called, what parameters were used, what changed, and what evidence supports the result. Hidden autonomy is not autonomy. It is an un-auditable background process.

Reversible. Prefer actions that can be rolled back, staged, or approved. Draft a message rather than send it. Build a change rather than deploy it. Create a branch rather than overwrite a mainline file. Ask for confirmation before crossing a meaningful boundary.

None of this makes an agent useless. It makes it trustworthy enough to use for real work.

Prompts are not permissions

A common mistake is to put safety rules in the prompt and call the problem solved.

Prompts matter. They describe intent. But they are not enforcement.

If an agent is told not to access an unrelated system while holding credentials that let it access that system, the actual control is the credential scope, the tool wrapper, the policy check, and the audit trail—not a sentence in its context.

The same principle applies to external data. An agent that reads the web, email, or documents can encounter hostile instructions disguised as content. The right defence is not hoping the model notices every trap. It is separating untrusted content from authority and enforcing what tools may do regardless of what the content says.

Models reason. Boundaries enforce.

You need both.

The autonomy gradient

Not every task deserves the same control level.

A useful agent system can move through stages:

  1. Suggest: analyse and recommend, but do nothing.
  2. Draft: prepare a command, change, or message for review.
  3. Act with approval: execute a specific pre-approved action.
  4. Act within a bounded policy: operate independently inside a narrow, monitored scope.

The mistake is jumping from stage one to stage four because the demo looked impressive.

Autonomy should be earned with evidence: reliable outcomes, clear scope, meaningful logs, safe failure modes, and a human who can understand what the agent did after the fact.

The boring controls are the product

People like watching agents use tools. It looks like intelligence becoming physical.

The unglamorous parts are more important: scoped credentials, allowlisted tools, dry runs, approval gates, rate limits, immutable logs, and defaults that fail closed.

Those controls are not friction around the product. They are the product.

An agent that can act without boundaries is not powerful in the useful sense. It is unpredictable with good marketing.

The future belongs to agents that can do serious work while making it obvious where their authority starts, where it ends, and what happens when they get it wrong.