Giving an AI agent a kill switch before you give it your credentials
The fastest way to get burned by an AI agent is to hand it your credentials and hope for the best. Agents are useful precisely because they act on their own. That is also exactly what makes them dangerous.
An agent doesn't get tired, doesn't hesitate, and doesn't feel the small flinch a person feels right before doing something irreversible. When it's right, that speed is the whole point. When it's wrong, it's wrong at machine speed, across every system you handed it.
Least privilege is not optional
Before an agent touches anything, ask the boring question: what is the smallest set of permissions this task actually needs? Not the account you happen to have lying around. Not "admin, just to be safe." The minimum.
A scoped, short-lived token that can read one bucket is a bad afternoon if it leaks. A long-lived key with full account access is a company-ending one. The difference is decided long before the agent runs, in how you handed it access.
Assume it will be wrong
Design for the moment the model is confident and wrong, because that moment is coming. The question is never "will it make a mistake," it's "what is the blast radius when it does."
Rate limits. Spending caps. A short list of actions that always require a human to say yes. None of this is expensive to build up front. All of it is expensive to add after an incident.
The kill switch
Every agent that can act should have one obvious way to stop it, the kind a tired person can find at 3am. A flag it checks before every action. A revoked token. A killed process. Whatever the mechanism, pulling it has to be faster than the agent is at acting.
If you can't answer "what did it do, and when" after the fact, you don't have an agent. You have a liability with an API key.
So it has to leave a trail. Every action logged, attributable, and reversible where it can be. An audit log isn't paperwork here. It's the only way you'll ever untangle what happened.
The trade you're actually making
Autonomy and safety pull against each other, and pretending they don't is how people end up on incident calls at the weekend. You give up a little of the magic, and in return you get a system you can actually trust with something real.
Give it the kill switch first. Then give it the keys.