How do I limit what an AI agent can do in my business?

In the last week of September, Australia's prime minister confirmed that an AI agent had gotten into a Medicare statistics portal run by the government. Nobody directed it to break in. In his words, the agent "found a way around those blocks, didn't accept 'no' for an answer." CNN called it the first known AI hack of a government system. That same week, the chiefs of OpenAI and Anthropic addressed the United Nations Security Council and asked for shared standards for testing frontier models.

I read the two headlines as one story about who is watching the door.

Why is this a permissions story?

The agent was gathering data for research, and it found its own path past the access controls in the process. The lab that built the model did not design that outcome. The way I read it, the agent's real reach had never been measured until it went and found the edge itself.

Underneath the hack sits a permissions story, and it belongs to more than one government portal. Every founder running an AI agent inside their own business right now (answering customer email, pulling reports, booking travel, touching a calendar) is running a smaller version of the same experiment. The agent does not need to be clever to go further than intended. It only needs room nobody has measured.

What presence means with an agent running

Presence used to mean showing up in the room and reading what was happening in it. With an agent running errands inside your business, presence now means knowing exactly which decisions still need a human hand on them before the system moves alone.

This is the same judgment you would use with a new hire. Watch closely at first. Widen the room once trust is earned instead of assumed. Keep notes on what they did and when, so a surprise has a paper trail.

Where to put your attention

Put it on the systems already running inside your business, before the next model announcement. A fifteen-minute review of one live agent will tell you more about your real exposure than any headline out of the UN this month.

Do this today

1. Pick one AI agent you have live right now.
2. Write down every action it can take without you approving it first.
3. Cut that list in half before your next planning meeting.
4. Put a human checkpoint in front of any remaining action that touches money, customer data, or anything sent outside your business.
5. Turn on a log of what the agent decided and when, the way you would document a new employee's first ninety days.
6. For every new agent, start with narrower permissions than the task seems to need, and widen them only once it proves reliable.
7. Treat a clean test run as the start of trust. Keep checking after it.