What to give an AI agent — and what to keep out of its hands

Before an agent touches real customer data, decide what it can see and what it can do. The rule of thumb: read broadly, write narrowly.

• Give agents their own accounts and API keys — never your personal login. You want to be able to revoke one key without changing every password.
• Let an agent draft before you let it send. Run two weeks in draft mode, review daily, then automate the categories it gets right.
• Keep secrets out of prompts. API keys and card numbers belong in a vault your agent references by name, not in chat history.
• Log everything. A good agent setup produces a trail you can audit — if your vendor can't show you what the agent did, that's a red flag.

Security isn't a reason to avoid agents — it's a checklist for the first week of using them.