How to run AI agents safely: the controls to ask for.
Run AI agents the way you run any system that can act for your company: each one can be paused, customer contact stays off until a person opens it, a person approves outbound work, outside text is treated as data, and there is a record of who did what.
The controls
- A pause switch per product. Off pauses it and touches no data. On restores it exactly.
- Gates on customer contact. Deploying code should not start contact. A gate opens on approval, after an internal test end to end.
- A person approves. Outbound work arrives drafted and waiting for an OK.
- Outside words are data, not instructions. An email or a form can contain text written to steer an agent, so it should reach the agent marked as untrusted.
- An audit trail. Who did what, when, and for whom.
- Rules before models. If a sender rule or a template can do the job, no model has to guess.
- Backups you can stand on. Continuous backups and a standby copy.
Eight questions for any AI vendor
- Can I pause one agent without touching my data?
- What has to be true before an agent can contact a customer?
- Who approves outbound work, and can I see the approval?
- How do you treat text that arrives from outside the company?
- What can each agent read, send, and change?
- Where does my data live, and how do I get all of it out?
- When was a restore last tested?
- What happens when a customer asks for a person?
How BigStarfish does it
These controls are how BigStarfish ships agents, from the first commit. The operating laws are published as TAO, the Trustworthy AI Operations standard, for anyone to adopt on any platform. BigStarfish Cyber Security also reviews AI and agent governance in a company's own tenant, with an inventory of the agents, assistants, and connectors found there.
Common questions
- How do you keep AI agents from contacting customers by mistake?
- Put customer contact behind a gate that is off by default. Deploying code should not open it. A person opens it after an internal test passes end to end.
- What is prompt injection, in plain terms?
- Text written to steer an agent, hidden in something like an email or a form. The defense is to mark outside text as untrusted, so agents treat it as data and not as instructions.
- What is TAO?
- Trustworthy AI Operations, the operating laws BigStarfish publishes for anyone to adopt, on any platform.
By William Jesse Boone, AI systems architect and founder of BigStarfish, in Missoula, Montana.