AI agents: how they differ from chatbots and how to limit their permissions

AI agents can use tools to perform tasks as well as generate text. The boundary between bots and agents depends on implementation, so concrete capabilities matter. Systems that change records or send data need permissions and checks outside the prompt itself.

Describe actions and their consequences

List tools such as search, record reading, drafting or task creation. Separate read and write actions. For example, finding an invoice and sending it to a customer have different effects and controls.

Agree resources, users and spending limits. Do not grant general administrative access merely to simplify API integration. Undefined or unsupported tasks should reach an accountable person.

Instructions do not replace server enforcement

An instruction not to delete data helps behaviour, but technical permissions should also prohibit unnecessary deletion. Validate permissions, parameters and context for each call. Keep secrets in managed systems rather than model-visible text.

Documents or external pages may contain third-party instructions. They must not be treated as system-owner authorisation. Search results remain task data; access and action policies are defined separately.

Approval should refer to a concrete action

Before consequential actions, show the recipient, contents, resource and relevant conditions. Approving a broad goal does not always authorise every operation. Controls should account for changed parameters.

Retries must not duplicate messages, documents or changes. Retain identifiers and verify outcomes after timeouts. An agent’s success statement does not prove tool execution.

Test boundaries and human handoff

Pilot normal requests, missing data, prohibited resources and third-party instructions embedded in material. Check logs and unnecessary disclosure. Test actions must not accidentally use live payments or send real messages.

Hand over tools, permissions, limits and owners. Retest relevant scenarios after model, instruction or API changes. Agents remain manageable when important actions can be explained and independently verified.

Sources and further reading

• OWASP: AI agent security
• OWASP: LLM prompt injection prevention
• MDN: idempotent operations

• Related subservice: AI agent development
• Explore this service area