AI Agents
A domain expert, with the boundaries written down first
Agents built around your process and your rules — with the tools they may call and what they must escalate defined before they run.
An agent is not a chatbot with ambition. It is a system that holds a goal, chooses actions, calls tools, and changes things in the world. That last part is what makes it useful and what makes it a governance problem.
Most agent failures are not the model saying something wrong. They are the agent doing something nobody authorised, using a permission nobody remembered granting.
So we build the boundary before the behaviour. What data can it reach, what tools can it call, what may it do without asking, what must it escalate, and what is logged. Those answers are the design — the prompt is an implementation detail.
Agent behavior is bounded by what you technically enforce, not by what you policy-require.
How we build
The design questions, answered before the build
These map onto the OWASP Top 10 for Agentic Applications, published December 2025, which names risk classes that simply do not exist in non-agentic deployments.
Scope of authority
Every tool the agent can call, enumerated and justified. Excessive agency has been a named OWASP risk since the 2025 LLM Top 10, and the 2026 agentic list breaks it into identity and privilege abuse, tool misuse, and unexpected code execution. The mitigation is boring and effective: grant less.
Identity — the agent is not the user
An agent acting on a user's behalf needs its own identity with its own permissions, not a borrowed session with the user's full rights. Non-human identity is one of the gaps NIST named when it launched its AI Agent Standards Initiative in February 2026.
Retrieval scoped to the requester
If the agent can read a document the requesting user could not open, you have built an access-control bypass with a friendly interface. The retrieval layer inherits your permission model rather than sitting beside it.
Untrusted input treated as untrusted
Anything the agent reads — an email, a ticket, a retrieved document, a web page — is potentially attacker-authored instructions. Prompt injection is not an edge case; it is the normal condition of an agent that reads things.
Escalation designed against fatigue
OWASP catalogues overwhelming the human in the loop as a distinct threat. An approval gate that fires constantly gets clicked through. We tune what escalates so the gate stays meaningful.
Evaluation before and after launch
A test suite that captures what correct looks like for your workflow, run against every model or prompt change. Without it you cannot tell an improvement from a regression, and you cannot show anyone that you checked.
Questions
Frequently asked
How is this different from workflow automation?
Automation follows a path you specified. An agent chooses a path. That flexibility is the value and the risk: a deterministic workflow fails predictably, whereas an agent can fail in ways nobody enumerated. Where the process is genuinely fixed, we will build the deterministic version — it is cheaper, more reliable, and easier to audit. We keep our workflow automation page for exactly that reason.
What standards apply to AI agents right now?
Fewer than you would hope. OWASP published a Top 10 for Agentic Applications in December 2025 and it is the most useful practitioner reference available. NIST launched an AI Agent Standards Initiative in February 2026, and its SP 800-53 control overlays for AI remain in development. The European Commission's AI Act Service Desk describes its own thinking on agents as preliminary. Anyone deploying agents today is operating ahead of the frameworks that will eventually govern them — which is an argument for implementing the controls the standards bodies have already named, not for waiting.
Who is accountable when an agent gets it wrong?
You are, in almost every regime that matters. Illinois attaches employment-AI liability to the deploying employer rather than the vendor unless a contract shifts it. That is why we push vendor terms covering model change notification, testing evidence and indemnification, and why the audit log is not optional.
Can you work with agents we have already built?
Yes, and it is often the more urgent engagement. A review of what an existing agent can reach, what it can do unsupervised, and what it logs frequently surfaces permissions nobody knew were granted. That is usually the fastest risk reduction available.
Interested in this agent?
Let's scope it against your compliance requirements and agree what it returns.