Separate answers from actions
A chatbot produces text; an agent can plan, choose a tool and modify another system. Classify operations as safe and automatic, reviewable, or critical with mandatory human approval. Sending mail, deleting data, changing payment details and granting access should not inherit the same policy as document search.
Scope identity to the task
Give the agent a dedicated identity with least privilege. Avoid reusable administrator tokens and unrestricted user sessions. For every tool, define allowed operations, data scope, credential lifetime and rate limits. Enforce the employee's access at retrieval time and again before an action, so an index or previous conversation cannot bypass source-system permissions.
Treat retrieved content as untrusted
Instructions may be hidden in an email, webpage, attachment or knowledge-base record. Keep that content separate from system policy. Return structured tool results, validate action arguments against a schema and apply business constraints such as approved recipients, amount thresholds and destination allowlists. One tool's output must not automatically grant authority to another.
Control memory and execution
Conversation context, user preferences and shared knowledge have different owners and retention periods. Isolate memory by organization, project and user; prevent unverified content from becoming durable instruction; and avoid retaining secrets without a documented need. Run high-risk tools in an isolated environment and provide a read-only fallback.
Audit the decision chain
Record the user, agent version, selected tool, validated arguments, policy result, human approval and external outcome as one trace. Redact secrets and unnecessary personal data, but preserve enough evidence for investigation. Before production, test token revocation, spending limits, emergency shutdown and recovery. A dependable agent is not assumed to be infallible: its mistakes are bounded, visible and reversible.