Notes for teams letting agents act., page 3
What changed in AI this week, and what it means for the agents you let act. Written for the people who sign off.
- posts
- 53
- updated
- feed
- rss
Kill switch, pause and rollback: what 'stop the agent' has to stop
A kill switch that stops new runs but not the one mid-payment is half a switch. What stop has to cover: in-flight actions, queued actions, scheduled runs and the credentials.
Least privilege for AI agents: how to scope what an agent can touch
Most agents run on a borrowed login with far more access than the job needs. Scope them by action, not by system, and enforce it outside the model.
Logs are a patch. Sealed records are the fix.
Logs were built so engineers could debug software. Agents that approve, pay and send need something else: a record per decision, sealed when it's made, that someone outside can check.
Microsoft Copilot Studio approvals: what the human review actions do, and where they stop
A fair reading of Copilot Studio's Request for information action and multistage approvals, from Microsoft's docs: what they pause, who they ask, and what they leave to you.
Model Context Protocol for operations teams: what to ask before you connect a server
MCP is the standard way agents plug into tools and data. A server can read your systems and act in them. What the spec itself says about consent and safety, and what to check before connecting one.
n8n human in the loop: Wait nodes, tool approval, and the who-clicked problem
n8n's three ways to put a person in front of an agent's action, read from its docs, and the difference between a link anyone can click and a verified approver.
OpenAI's agents tried to hack in when the normal route failed. What your approver should check now.
OpenAI's agents were doing ordinary data lookups. When the normal route was blocked, some tried to hack in. Your agent will get blocked too. Here is what to check.
Plugin4Shell: a reviewed plugin didn't stay reviewed. What your security team should check now.
Four major coding agents shared one flaw that let a reviewed, pinned plugin turn malicious on auto-update. Your agents' add-ons are a supply chain now. Treat them like one.
Prompt injection in accounts payable: what an invoice can tell your agent to do
An invoice is text a stranger wrote, and your agent reads all of it. Prompt injection turns that text into instructions. You can't filter it out. You can limit what it can do.
Retries, idempotency and side effects: why a retried agent pays twice
An agent that retries 'pay invoice' after a timeout can pay it twice. What idempotency means, why agents make it worse, and what to check before an agent gets write access.
Segregation of duties for AI agents: when one agent initiates and approves
Segregation of duties says no one person should initiate, approve and record the same transaction. An agent that does all three breaks the rule. How to map SoD onto agents.
What is shadow mode for AI agents?
Shadow mode runs the agent on live work while your people still do the job. The agent decides, nothing happens, and you compare. It is the cheapest go-live test there is.
The controls in these notes are what Gatehouse, Surehand’s control plane, enforces at runtime.
See Gatehouse