Grant agents only the tools, data access, and permissions they need for their specific task. Minimize the gap between authorized scope and capable scope. Review and reduce footprint periodically.

State not just what the agent should achieve but what it must not do — explicit prohibitions on methods, resource types, scope expansion, and self-modification. Complement objective specification with constraint specification.

Monitor cumulative effects and behavioral patterns, not just individual actions. Detect anomalous tool usage, unexpected capability combinations, and metric patterns inconsistent with expected behavior.

Technically constrain what actions the agent can take, independent of what it is instructed to do. Sandboxing enforces limits that instruction-following cannot — it is effective even after goal injection succeeds.

Establish automated checks that flag specific high-risk behavioral patterns: bulk operations above threshold, self-modification attempts, anomalous access patterns, or deviation from expected action sequences.

For actions above defined impact, irreversibility, or novelty thresholds, require explicit human approval before the action executes — not passive approval, explicit approval. The agent proposes; the human decides.

Prefer reversible over irreversible actions, especially for high-impact operations. Stage irreversible actions with a reversibility window. Never delete data without confirmed backup. Never make permanent changes in a single step.

Technically enforce the principal hierarchy: agents can only execute actions within the scope authorized by their position in the hierarchy. An agent cannot grant itself permissions higher than its principal authorized.

Proactively test for rogue behavior: adversarial goal injection attempts, proxy exploitation scenarios, capability boundary discovery, and multi-step chain detection. Test in staging before and continuously after deployment.