Purpose and fit

Use this before an agent receives tool access, and again when its task or permissions expand. Start with a bounded task and only the access required for that task.

Before you start

Use the bounded task brief and permission/settings descriptions you already have. List the actual systems, allowed targets and proposed actions without sharing credentials or secrets. Missing control evidence is an open question, not a reason to manufacture a test dataset or assume a control exists.

Use only information you are authorised to share with the chosen AI tool. Adjust the prompt to the fields and context you actually have; a specially created dataset is not required.

Required inputs

  • A single task objective and definition of done
  • The exact systems, objects and data the task needs
  • The proposed actions, affected recipients and possible consequences
  • Available controls for approvals, logging, stopping and recovery

Practical workflow

  1. Write the allowed task and explicit exclusions. Define the systems, records, recipients and time window within scope.
  2. List read, draft and change permissions separately. Specify each allowed action and target; leave unknown actions unapproved.
  3. Place approval gates before consequential actions. Define what evidence the approver must see and how the actual system will enforce the gate.
  4. Define stop conditions, operating limits and a safe response to uncertainty. Treat instructions embedded in retrieved content as untrusted unless separately authorised.
  5. Have the system owner verify controls, then test allowed and forbidden actions in a safe environment. Run no live action until its required authorisation and checks are in place.

Expected output

Expect a delegation-brief draft and an uncompleted control-verification checklist. Written boundaries do not establish that an agent can enforce them. The system owner must test real permissions and stop behaviour before the relevant live actions are enabled.

A bounded delegation brief and a control-test record. The brief identifies the task owner, access owner, allowed actions, approval points, limits, stop contact and recovery method.

Human checks

The process owner confirms the purpose and consequences. The system owner checks enforced permissions against the written brief, including nested tools and integrations. Verify that stopping the agent actually prevents further actions and that any in-flight action is handled. Review logs for the minimum useful record; do not copy secrets into them.

Limitations

A prompt is not an access-control system. An agent’s promise to ask is insufficient without an appropriate enforced control. Some actions cannot be undone; a “rollback” label does not make them reversible. Tool and permission changes need renewed checks.

Starter checklist

Agent task: ____________________ Process owner / system owner: ____________________ Task expires or is reviewed on: ____________________

  • Objective and definition of done are specific.
  • Exact systems, records, recipients and data scope are listed.
  • Read, draft and change permissions are listed separately.
  • Allowed actions and targets are explicit; all others stay out of scope.
  • External sends, spending, deletion, permission changes and other consequential actions have appropriate approval gates.
  • Approval gates are enforced and tested in the actual system.
  • Missing approval, conflicting instructions, unexpected targets, failed checks and access errors trigger a stop.
  • Instructions in retrieved files, messages and webpages cannot expand authority.
  • Volume, cost and time limits are appropriate and enforced where available.
  • A person can stop the task; in-flight actions have a defined response.
  • A safe test covers both permitted and forbidden actions.
  • The owner has checked what can be restored and what cannot.
  • Records support review without storing unnecessary sensitive content.

Unresolved gate / owner / next step: ____________________ Ready for the authorised test? Yes / No, with reason: ____________________

Optional AI drafting prompt

Help me prepare the checklist above using only these authorised notes: [insert the available task, role and configuration notes]. Adapt the fields to my actual context.

Separate documented intentions from verified controls. For each permission or approval gate include the target, evidence available, unresolved check and responsible owner. Keep control-test results blank or marked not tested unless actual results are supplied. Do not grant access, run actions or represent a prompt instruction as an enforced control.

Before drafting, ask a focused question if a missing detail materially changes the task or acceptance criteria. Otherwise produce a clearly limited draft and list the gaps. Label any non-critical assumptions; never invent facts, figures, sources, approvals or completed actions.

Data and AI output disclaimer

Use relevant data that exists or that you provide, with accuracy and completeness sufficient for the task. Different AI models and versions may produce different results, and responses may vary between runs. You are responsible for checking and validating the output against your own requirements, source information and acceptance criteria before relying on it.