Agent identity
Give each agent/workload an attributable identity and explicit purpose; do not share broad human credentials.
Open reference architecture
Enterprise AI Agent Architecture
A control model for agents that can call tools or change business systems. Autonomy should increase only when permissions, evidence, reversibility and oversight justify it.
Tool boundary
Expose narrowly scoped tools with typed inputs, server-side authorisation, rate limits and deterministic validation.
Approval gates
Require human approval for payments, deletion, external publication, contractual commitments, privilege changes and other consequential actions.
Memory & context
Separate transient context from durable memory; define retention, provenance, tenant boundaries and deletion.
Planning limits
Constrain iteration, time, spend and tool-call budgets; detect loops and stop safely.
Untrusted content
Treat web pages, email, documents, retrieved text and tool output as untrusted data, not instructions with authority.
Auditability
Record agent/version, policy decisions, tool requests/results, approvals and material state changes while minimising sensitive logging.
Fail-safe operation
Use idempotency, reversible actions, circuit breakers and escalation paths; inability to reason safely should result in no action.