Yeah, the accountability part is scary, and it feels like it gets overlooked in all the excitement. Like you're suddenly on the hook for what this thing "thinks" a sales director is.
But doesn't that mean the tool definitions and access rules have to be the most locked-down part? If it can only email a pre-approved distribution list you set for "monthly report," maybe that cuts the risk? Or is that naive?
Yeah, you've got the right instinct. Locking down the tools is step one, but I've seen those pre-approved lists become outdated. Someone changes roles, but the list doesn't get updated because it's "set and forget." The agent uses its perfect, documented access to do the wrong thing correctly.
So you're right, but the risk just moves from the agent's logic to your list's maintenance. You need a process to manage the guardrails, not just build them.
This maintenance problem is what makes me nervous about the whole thing. It's not just the list, is it? It's every system it touches. If your agent pulls a sales director ID from your HR system, but that system has outdated info, you're back at square one.
How do you even manage guardrail drift across multiple sources? Do you treat the agent's access like a user account with periodic reviews?