Autonomy without boundaries is not freedom — it is exposure. The goal of agent controls is not to slow agents down but to let them act confidently inside a defined space, where routine operations flow and anything unusual reaches a person. This is a practical guide to the controls, data patterns and operating rules that make that space real.

Controls that work

The controls that hold in practice share one property: they sit outside the agent's reach.

  • Limits, applied by the system, not the model.
  • Approved counterparties, so an agent cannot invent a recipient.
  • Approval thresholds that route larger operations to a human.
  • A single validation step — reliance, sanctions, profile, mandate, anomalies — before funds move.

An agent can propose; it cannot overrule any of these. That asymmetry — a proposal from the agent, a decision from the system — is what makes the controls reliable no matter how the model behaves.

Data patterns

Controls need data to act on. Useful patterns:

  • every operation tied to a principal, an agent and a policy version;
  • a policy hash, so the rules in force are identifiable later;
  • a ledger with evidence, recording not just what happened but under which mandate.

These turn controls from snapshots into a record — something that can be reviewed later, not just enforced in the moment.

Operating rules

Day to day, a few habits keep autonomy safe: start with tight limits and widen them as confidence grows; keep policy below the model so it stays unarguable; make escalation the default for the unusual, with the invoice and counterparty attached; and review the ledger regularly, not just after an incident. Controls are only as good as the discipline around them, and a boundary that is never reviewed slowly stops matching the business it was drawn for.

A boundary, not a brake

It is worth saying plainly what these controls are not. They are not a brake on autonomy; they are the condition that makes autonomy usable. An agent that can act only where it is allowed needs less supervision, not more, because the exceptional cases are exactly the ones that reach a person. The boundary is what lets a business hand over real work with confidence.

In short

  • Controls must sit outside the agent's reach.
  • Limits, allowlists and thresholds are the core boundary.
  • Data patterns keep every operation traceable.
  • Start tight, escalate the unusual, review often.

See how these controls are implemented on the agent layer.