An agent that only drafts an answer is easy to contain. An agent that refunds a payment, changes access or edits production data is part of the control plane. At that point the design question is no longer model accuracy alone. The system must limit what can change and make every action recoverable.
List writable state before listing tools
Classify actions by impact and reversibility. Reading a ticket, drafting a response, creating a low-risk record and changing a financial state should not share the same approval or credential.
Give tools strict input contracts
Expose existing business APIs instead of direct database access. Validate identifiers, amounts, scopes and idempotency at the tool boundary even when the model produced a plausible request.
Make approval useful
An approver needs the exact action, target, changed fields, policy result and recovery path. Approval is a product surface for risk review, not a way to transfer responsibility to a person.
Expand authority from failure evidence
Link model proposals, policy checks, approvals and final API results with one correlation ID. Long operations need durable state and idempotent retries. Increase authority only after the current scope has produced understandable and recoverable failures.