Deploying Always-On Agents
Give agents their own identities, approval tiers, audit logs and a staged pilot before widening their autonomy.
Deploying Always-On Agents
Always-on agents act inside the customer's systems on their own schedule: triaging inboxes, chasing suppliers, reconciling records, watching dashboards. Deploying one safely uses the same controls an organisation applies to a new employee:
The models will keep improving. These controls are what let an organisation say yes to agents now.
Why it matters
An agent using a person's credentials has all of that person's access, makes the logs ambiguous (did the person or the agent do this?), and can only be stopped by locking the person out.
Agents also read untrusted text all day: emails, documents, web pages. Text that looks like instructions can steer them, which is prompt injection. An over-privileged agent turns a malicious email into an incident. Most of this risk is removed by identity, permission and approval design, not by a better model.
Finally, autonomy that is granted all at once is usually withdrawn all at once, after the first mistake. A staged rollout keeps the programme alive.
How to do it
Define one job with a named business owner, the systems it touches and what good looks like.
Create a non-human identity with scoped, short-lived credentials for exactly those systems.
Write risk tiers in code, as in the policy below: read, reversible internal changes, external or irreversible actions, and anything touching money, identity or access.
Log every tool call, with its arguments and result, to the customer's SIEM under the agent's identity.
Evaluate in shadow mode on past cases: the agent proposes, nothing is executed, and people compare.
Move to supervised mode, where approvals are required for higher tiers.
Widen autonomy one tier at a time, on evidence from the audit log and the evaluation.
Approval tiers in code
from enum import IntEnum
class Tier(IntEnum):
READ = 0 # search, read records: allow and log
INTERNAL = 1 # drafts, labels, tickets, holds: allow, log, daily digest
EXTERNAL = 2 # send email, submit forms, delete: ask the owner
CRITICAL = 3 # money, identity, access: named approver, never automatic
TOOL_TIERS = {
"read_invoice": Tier.READ,
"draft_reminder": Tier.INTERNAL,
"send_reminder": Tier.EXTERNAL,
"update_supplier_bank_details": Tier.CRITICAL,
}
def decide(tool: str, mode: str) -> str:
"""mode: 'shadow' (nothing executes), 'supervised' or 'autonomous'."""
tier = TOOL_TIERS.get(tool, Tier.CRITICAL) # unknown tools are treated as critical
if mode == "shadow":
return "propose_only"
if tier == Tier.CRITICAL:
return "ask_named_approver" # never automatic, in any mode
if tier == Tier.EXTERNAL and mode == "supervised":
return "ask_owner"
return "allow"
# A model reviewer may escalate a decision to a person, but can never downgrade one.Worked example: an accounts-payable agent
The job: read incoming invoices, match them to purchase orders, and chase suppliers for missing documents.
When a supplier email asks to "update our bank account urgently", the agent drafts the request for a person. It cannot do anything else.
In a real engagement
Never let an agent change payment details, permissions or identities without a named approver, however good its track record.
Treat agents that share one runtime, memory or credential store as a single identity for risk purposes: a compromise of one is a compromise of all.
Test revocation before go-live: the customer should be able to stop the agent in one step, in minutes, without a deployment.
Re-run the evaluation when the vendor changes the model, and review the audit log weekly with the business owner during the pilot.
Challenge
An accounts-payable agent will read invoices and chase suppliers by email. Assign each of these to a tier: reading an invoice, drafting a reminder, sending a reminder, updating a supplier's bank account. Then describe what evidence would justify letting it send reminders without approval.
Checklist
Production checklist
0 of 9 checked
Knowledge check
Which action should an agent never perform without a named human approver?
Complete
You have finished “Deploying Always-On Agents”. Continue to the next chapter or practise in the FDE simulator.
Mark this chapter as complete
Track your progress and unlock the next chapter.