Study first
Review the ideas behind the questions
Review agent controls before an AI workflow can send, publish, edit, delete, or change live marketing work. Focus on tool scope, permissions, output validation, approval, and recovery.
Limit what the AI can do
An AI agent becomes riskier when it can act in other systems. Before it touches campaign calendars, customer data, or publishing queues, limit what it can do, what it can access, and when it needs approval.
- Risk goes up when an agent can use too many features, access too much data, or act without enough approval.
- Connected tools should be limited to the features needed for the task.
- High-impact actions should require human approval before they happen.
In Practice
Read Is Safer Than Write
If the job is summarizing campaign notes, the tool should not also be able to change the launch calendar.
Approval Belongs In The Workflow
A policy reminder in a prompt is weaker than an actual approval step before the agent publishes or sends work.
Common mistakes
Giving the agent broad access because the first task is low risk.
Limit tools and permissions to the intended task before adding higher-risk work.
Q&A
What is the first control for an AI agent that can act in other systems?
Limit the connected tools and permissions to the minimum needed for the task.
When is human approval most important?
Require approval before high-impact actions such as publishing, sending, deleting, or changing customer-facing work.
Treat AI Output As Untrusted Input
Agent controls fail when generated text is passed straight into a browser, database, publishing tool, or workflow action. Model output needs validation, encoding, and policy checks before it reaches a downstream system.
- Improper output handling means generated output is not validated, sanitized, or handled before downstream use.
- Generated HTML, JavaScript, queries, file paths, or email templates can create security risk if used without proper handling.
- External content can carry prompt-injection instructions that are not obvious to the marketer.
In Practice
Validate Before Publishing
Generated markup or links should pass the same checks as user input before a publishing tool renders them.
Separate Outside Content
Customer messages, reviews, webpages, and competitor copy should be marked as material to analyze, not instructions to follow.
Common mistakes
Letting generated code-like text run because it came from an approved AI workflow.
Validate, sanitize, encode, or block the output before it reaches the downstream system.
Q&A
Why is generated output treated like untrusted input?
Prompts and outside content can influence it, so downstream systems need validation before acting on it.
What should happen to outside content before the model reads it?
Separate and label it as external material so it has less ability to change the trusted task.
Plan For Failure Before The Launch
Agent workflows need a response plan because mistakes can spread quickly through connected systems. Before launch, set up logs, monitoring, recovery steps, and one owner who can stop risky behavior.
- Third-party AI risks and contingency processes should be planned for high-risk failures or incidents.
- Post-deployment monitoring should capture user input, overrides, incident response, recovery, and change management.
- Logging and monitoring connected-agent activity can limit damage when the agent can do too much.
In Practice
Name The Stop Owner
If an agent starts changing the wrong assets, someone needs authority to pause the workflow and start recovery.
Watch The Downstream System
Agent logs alone are not enough if the connected system is where the change, send, or deletion happens.
Common mistakes
Approving an agent because the prompt says it will be careful.
Add monitoring, logging, recovery, and stop authority before the agent can affect live work.
Q&A
What should be in an agent failure plan?
Include monitoring, logs, an owner who can stop the workflow, recovery steps, and change control.
Why monitor downstream systems too?
The agent's harmful effect may appear where the connected system sends, publishes, changes, or stores the work.