Keep a human in the loop

If you remember one safety habit for AI agents, make it this: keep a human in the loop for consequential actions. It's the simplest, most effective protection, and it's what separates safe agent use from risky agent use.

What it means. For anything consequential or irreversible — sending a message, deleting files, making a purchase, publishing something, changing important settings — the agent should stop and get your explicit approval before acting, not just do it. You stay the decision-maker on things that matter; the agent does the legwork and checks with you at the critical moment.

Why it's so effective. Remember that agents are unreliable on complex tasks, can be manipulated by hidden instructions, and sound confident even when wrong. A human checkpoint at the consequential steps catches all of those before they cause harm — a wrong action gets stopped at the "are you sure?" moment. It turns a potentially costly autonomous mistake into a caught-in-time near-miss.

The companion habit — least privilege (limit access). Alongside human approval, give the agent only the access the task actually needs, not everything by default:

• Prefer read-only access over the ability to change things, when you can.
• Don't connect an agent to your entire inbox, files, and accounts if the task only needs one folder.
• Grant narrow, specific permissions rather than broad ones.

This limits the "blast radius" — even if the agent goes wrong or is manipulated, it can't do much, because it doesn't have access to much.

Together, these two habits — human approval for consequential actions, and least-privilege access — are your core agent safety net. One limits what an agent can do; the other ensures you approve the moments that matter. With both in place, you get the agent's help while staying protected from its unreliability and the manipulation risks.

The mindset: the single most important agent-safety habit is keeping a human in the loop for consequential actions — the agent should get your explicit approval before anything irreversible (sending, deleting, buying, publishing), so a wrong or manipulated action is caught at the "are you sure?" moment. Pair it with least privilege — give the agent only the narrow access the task needs, preferring read-only, so even a mistake can't do much damage. Human approval on what matters, plus limited access, is the safety net that lets you use agents confidently. Never hand an agent broad access and free rein on consequential actions.