Autonomy is a workflow decision
An agent that can find a document has a different job from one that can change a customer record. Putting both behind the same tool access makes a demo easy to build and a production system harder to reason about.
Anthropic's research on agent autonomy examines how people delegate work and supervise tools. For a business deployment, the practical question is which actions a particular workflow should allow, and what evidence makes those actions reviewable.
Give each tool a small, clear job
Consider an assistant that prepares a response to a customer. It can search approved guidance, read the relevant case, and create a draft. Sending the response or changing an account should use separate operations, each with the permissions that the current user and case actually allow.
Enforce those limits in the backend. Keep credentials outside prompts, check access on every call, and pass identifiers rather than letting the model invent unrestricted queries. A narrow tool can return a useful result and a clear failure when access is unavailable.
Review the action people can understand
A confirmation is useful when it shows the concrete change: the recipient, the message, or the fields that will be updated. A generic permission prompt gives the reviewer much less to assess. Routine reads can remain fast while changes to shared records receive the appropriate review.
Record the request, tool inputs, result, and final action together. This gives support teams a way to explain an outcome and engineers a way to reproduce a failure. Logs should expose what operators need without becoming another copy of sensitive source data.
Test the boundary as part of the task
Anthropic's guide to agent evaluations distinguishes a convincing transcript from the final state of the environment. That distinction is useful for permission testing: inspect what the agent actually read or changed.
Build cases for missing access, expired context, duplicate requests, and a document that tries to redirect the agent. Check both useful completion and containment. A support workflow should still create the right draft when one source is unavailable, and should leave account state untouched when an update is outside its scope.
Sources & further reading
Written by Gilles Jacobs, AI & data engineering consultant at Exverbai.
