Why this matters
An AI agent that reads client email, sorts it and drafts replies can save a small firm hours every week. The risk starts the day it can act: send a message, move a file, pay a bill or delete something. A wrong amount, a clumsy sentence or one hidden instruction in a vendor email, and the damage is done before anyone looks.
Most owners react in one of two ways: they never switch the agent on, or they check every single thing it does, which takes back the time it saved. This module is the middle path, and it works in any tool: decide what the agent can touch, which actions need a person, where the rules live and what gets logged.
What you’ll build
You help Dana Ortiz, who runs Larkspur Tax & Bookkeeping, a made-up 9-person firm, set up the safety around an inbox agent. You go through the access it is offered and keep, narrow or remove each one, follow one client email through an approval step, read the four rules of a policy engine, check an audit trail from one Tuesday morning and finish with a five-question checklist.
Every screen is a Stepthrough worksheet, not a real app, so nothing is connected and nothing is sent. The next modules practice the same ideas in Airia, n8n and Guardian.
What you need
- NothingThe practice is a worksheet in your browser. No account, no tools, no data.
- A list of your own agents, to do it for realAny AI tool that can act for you: an n8n or Zapier workflow with an AI step, ChatGPT or Claude with connectors, an Airia agent.
Concepts
3 ideas you’ll use in the practice.
Least privilege
Least privilege means an agent gets only the access its job needs. When you connect an app, it usually offers far more: read, send, delete, every folder. Keep what the job needs, narrow the rest to one inbox or one folder, and remove what it never needs, such as paying bills.
Access you do not give cannot be misused, by a mistake or by an attacker. See AI agent permissions.
Human in the loop, only where it matters
Human in the loop means a person approves an action before it happens. Use it for actions that reach a client, move money or cannot be undone. Let reading, labeling and drafting run on their own.
An approval workflow holds the action in an approval inbox with the reason, and the person can approve, edit or reject it.
A policy engine and an audit trail
A policy engine checks every action before it runs and answers Allow, Needs approval or Deny. The rules live outside the AI, so a prompt injection hidden in an email cannot change them. Deny by default means any action with no rule is blocked.
An audit trail logs each action, the rule that answered, who approved it and when. It is how you answer a client, an insurer or your own question: what did the agent do on Tuesday?
Practice
Do every step yourself in a practice copy of the real tool. It checks your work, and “Do it for me” finishes any step you get stuck on.
Do it for real
Now repeat it in your own account. Tick each step as you go.
Quick check
3 questions to check you’ve got it.
1. An agent only sorts email and drafts replies. Which access should it have?
- Full access, with a prompt telling it to be careful
- Read the client inbox, create drafts, save to one folder
- Read, send and delete
Show the answer
Read the client inbox, create drafts, save to one folder. Least privilege: only what the job needs. An instruction is not a lock.
2. Which action should wait for a person?
- Labeling an email
- Emailing a client their balance due
- Reading a new email
Show the answer
Emailing a client their balance due. It reaches a client, has a number in it and cannot be unsent.
3. A hidden line in an email tells the agent to pay an invoice. What stops it?
- The prompt said never pay
- A rule outside the AI that denies payments
- The agent always notices tricks
Show the answer
A rule outside the AI that denies payments. Prompt injection can talk an AI out of its instructions. It cannot change a rule the AI never sees.
Catch a Poisoned Email Before Your AI Assistant Obeys It using Claude
You know why rules belong outside the prompt. Next, see the attack that proves it: a poisoned email that talks to your AI assistant.
Start module 4 →