The guardrail questions to ask before an AI agent touches your systems

The question

What we told them

That's the right question, and it's telling how rarely a sales demo answers it. The protection has a name — guardrails — and it belongs at every point where the agent touches the outside world. Three checkpoints:

• Before the request goes in. Screen what reaches the agent: off-topic requests, policy violations, and prompt injection — instructions smuggled into an email or document the agent reads. A small, cheap model doing this triage before the main one runs is standard practice.
• Around every action. Before a tool call executes — send, update, delete — a check runs on what's about to happen and can block it or route it for sign-off. A second check inspects what came back before the agent acts on it. This is the checkpoint that matters most, because actions are the part you can't take back.
• Before anything leaves. A final pass over whatever a customer or your team will see: leaked internal data, commitments the agent has no business making, tone that isn't yours.

Two operating rules on top of the checkpoints. First, least privilege: the agent gets the narrowest access that still does the job — drafting rights instead of send rights, one pipeline instead of the whole CRM. Second, a human approves anything irreversible: anything sent, deleted, or paid. You can loosen both later, once there's a track record. You can't retract a client email by apologizing to the log file.

When you're evaluating a vendor, skip the demo theater and ask what runs between “the model decided” and “the action fired.” A builder who has thought about this will answer in specifics. One who hasn't will change the subject back to the demo.