A chatbot responds. An agent can choose a tool, prepare parameters, trigger an action and observe the result. This capability opens up useful uses: create a ticket, prepare an order, update a file or orchestrate a search. It also changes the nature of the risk. A wrong answer becomes a real operation.
An agent's safety does not rest on his good will or on a prompt asking him to be careful. It relies on bounded tools, verified authorizations, validations, idempotence and model-independent traceability.
Distinguishing conversation, decision and execution
The system must separate:
- the intention expressed by the user;
- the interpretation and plan proposed by the model;
- the decision to authorize;
- execution by a deterministic service;
- verification of the result.
The model may suggest. The policy layer decides whether the tool is available, whether the user has the right, and whether approval is required. The business service validates the parameters and applies the rules as for any other interface.
Propagate user identity
An agent should not act under a generic administrator account. The action must be linked to the identity, organization and context of the person asking. When the agent uses a service account, it carries a verifiable and limited delegation.
Rights are controlled for each tool and resource. A prior conversation does not constitute lasting authorization. Delegations expire and cannot be extended by the template.
Design narrow tools
A secure tool corresponds to a specific business capability: creer_brouillon_commande, rechercher_dossiers_autorises or proposer_creneaux. It has a strict input schema, validations, scope and structured output.
Conversely, a executer_sql, appeler_url, or lancer_commande tool gives the model too wide a gap. Even protected by a locker, it greatly increases the risk of exfiltration or destruction.
The tools expose minimal data and hide secrets. They do not accept free parameters when an authorized list is possible.
Classify stocks by risk level
A pragmatic classification can distinguish:
- reading of already authorized data;
- proposal without modification;
- reversible creation in draft;
- action with confirmation from the user;
- action with independent approval;
- action prohibited to the agent.
The level depends on impact, scope and reversibility. Sending a draft to yourself and sending a contract to a thousand recipients are not the same policy.
Secure cycle of an agentic action from intention to verification and compensation.
Preview before you act
For a sensitive action, the agent produces a clear representation: object, recipients, modified data, amount, consequences and possibility of return. The user confirms the exact action, not a vague wording like “continue” after several exchanges.
The confirmation expires and is linked to a hash of the parameters. If the agent modifies the order, a new validation is necessary.
Apply idempotence
Agents can repeat a call after a delay or an ambiguous response. Each creation or payment operation uses an idempotency key and returns the status of an existing attempt.
The tool distinguishes failure before execution, unknown result and success. The model should not guess that an operation has failed and retry it freely.
Check result
A successful HTTP response does not guarantee that the business objective is achieved. After execution, the system rereads the state, checks the invariants and compares the expected result.
The agent only announces what is confirmed. It can say that a request is "saved and pending" rather than "processed" when the workflow is not completed.
Prévoir la compensation
Some actions can be undone; others require a reverse operation or intervention. Each tool documents:
- cancellation window;
- possible compensation;
- data to be kept;
- responsible ;
- communication to send.
A financial transaction or an external message may be difficult to reverse. The approval threshold must take this into account.
Defending against prompt injection
Emails, pages and documents viewed may contain malicious instructions. The system treats them as data. They cannot modify the tools list, policies, or secrets.
Retrieved data is scoped, actions require independent rules, and outputs are filtered before being used as parameters. An instruction from external content cannot trigger an approval.
Limit exfiltration
An external sending or storage tool can be used to exfiltrate data. Destinations are controlled: domains, accounts, channels and volumes. Attachments and sensitive fields are detected according to organizational policy.
The agent does not receive API secrets. Connectors use them on the server side and never return them in the results.
Memoire et context
Conversational memory can mix folders, users or periods. Each stored element has an owner, a scope and a duration. Sensitive data is not retained by default.
Before an action, critical parameters are read back from the source of truth, not from a potentially old conversation summary.
Journal d'audit
The log must make it possible to reconstruct:
- request and identity;
- policy version;
- selected plan and tools;
- parameters validated;
- approvals;
- appeals and results;
- verification ;
- error or compensation.
Complete prompts should not be retained unnecessarily. Logging respects minimization, access rights and retention period.
Environnements et limites
Test agents do not use production tools. Actions are limited by amount, volume, frequency, time and scope. A cut-off mechanism allows you to deactivate a tool or agent quickly.
Outbound calls, downloads and code executions can be placed in isolated environments with limited network and time.
Testing adverse scenarios
Tests include:
- malicious instruction in a document;
- user without rights;
- accumulation of roles;
- parameter outside the diagram;
- repetition after delay;
- tool unavailable;
- partial response;
- attempt to send to a prohibited destination;
- expired approval;
- change of parameters after validation.
Expected behaviors are automated where possible and replayed at each model change or prompt.
Superviser l'autonomie
The indicators track the rate of actions proposed, approved, modified, failed, canceled and compensated. The gaps between plan and result are analyzed. An unusual volume or new destination triggers an alert.
Autonomy can be gradually increased for a stable tool, on limited amounts and populations. It can also be reduced immediately.
Building a first use case
The best driver is frequent, bounded, reversible and measurable. For example: search for authorized information, prepare a draft, request validation then create a task. It avoids payments, mass deletions or regulatory decisions.
The pilot establishes the reusable foundations: identity, policy engine, tool registry, approval, audit and observability.
The agent as a new user of SI
An agent should be treated as a highly automated actor, subject to more controls, not less. Business rules remain in the services, powers are limited and each action is provable.
Partitech can design agents linked to applications, APIs and data, with tight tooling, permission governance and human validation. Value comes from safely automating a process, not from the number of tools available to the model.
Let's talk about your project
Identify and secure a first agentic process with Partitech. Contact Partitech.