What Should Every AI Agent Have Before It Runs?

An AI agent should not begin with a clever prompt. It should begin with a clear job and clear limits.

Before an agent touches a shared inbox, a spreadsheet, a CRM, or a customer-facing channel, decide what it may do, who owns it, what it may spend, and how it stops. That makes the agent easier to review before it becomes part of a real process.

What is the minimum setup for an AI agent?

Every AI agent needs a defined job, limited access, a named owner, a budget, stop conditions, and an off switch before it runs.

Use this launch list:

1. One job. State the recurring task in plain language. “Draft a reply for review” is a job. “Help with sales” is not.
2. A trigger. Say what starts the work. It might be a new form submission, a scheduled run, or a person assigning a task.
3. Approved inputs. List the systems, files, and fields the agent may read.
4. Allowed actions. List what the agent may create, change, or send. Keep the list short.
5. A finished output. Define what the agent hands back and where it puts it.
6. A named owner. One person should be responsible for checking the output, changing the rules, and deciding whether the agent stays on.
7. A budget and an off switch. Set the spending cap and the practical way to stop the agent quickly.

This is a control list, not red tape. The OWASP guidance on excessive agency recommends limiting an AI system's tools and permissions, keeping high-impact actions behind authorization, and applying human oversight where it is needed. The NIST AI Risk Management Framework also treats risk management as work that continues through an AI system's lifecycle.

Why does an AI agent need one defined job?

A defined job gives the agent a boundary that a reviewer can test. It also makes a bad output easier to trace back to the rule that needs changing.

Write the job as a sentence that names the input and result. For example: “Read new vendor requests and prepare a draft summary for the operations manager.” The agent can still use several steps to do that work. The person reviewing it can still tell whether it finished the right work.

If the job needs several unrelated outcomes, split it into separate agents or separate stages. Separate stages let you give each step only the access it needs. That follows the least-privilege approach in OWASP's guidance.

For a broader view of jobs an agent can take on in a construction or AEC firm, read What AI Agents Actually Do at an AEC Firm.

What access should an AI agent have?

An AI agent should have only the data and tools required for its stated job. Do not give an agent broad access because it might be useful later.

Make the access list specific:

• The inbox, folder, table, or API it may read.
• The records it may create or update.
• The actions it may not take without a person's approval.
• The systems it cannot access at all.

An agent that drafts a reply does not need permission to send it. An agent that summarizes an estimate does not need permission to revise the estimate. Restricting tools and permissions reduces the chance that a flawed instruction becomes a larger action. OWASP identifies excessive permissions and unsafe action scope as risks for LLM-based applications.

Who should own an AI agent?

A real person should own every agent that runs in a business process. That person is responsible for the review point, the access rules, and the decision to pause or retire the agent.

The owner does not need to read every line forever. The owner does need to know what good output looks like and where the agent can cause harm. The NIST AI RMF frames governance, accountability, and ongoing risk management as part of managing AI risk.

Write the owner's name next to the agent's job. If nobody can name the owner, the agent is not ready to run.

What does an AI agent budget do?

An AI agent budget sets a limit on what the agent may spend before it needs attention. The cap can cover model usage, connected services, or both.

The amount depends on the job. The important part is not choosing one universal number. The important part is choosing a number deliberately, assigning someone to watch it, and deciding what happens when the cap is reached.

A useful rule is simple: reaching the cap stops the agent or routes the work to a person. A budget is a boundary, not a dashboard decoration.

What is an AI agent off switch?

An AI agent off switch is the tested way to stop the agent from taking more actions. It should work without rebuilding the system or hunting through several tools.

For a scheduled agent, the off switch may disable the schedule. For an agent that calls outside tools, it may also disable the credential or revoke the permission that allows the action. The right method depends on the agent's design.

Document three things before launch:

1. The person who can turn the agent off.
2. The exact step that stops new work.
3. What happens to work already in progress.

Test the switch before the agent handles live work. A stop control that has never been tested is an assumption, not a safeguard.

What should you check before the first run?

Run this short check with the agent owner:

• Can we describe the agent's job in one sentence?
• Do we know exactly what starts it?
• Can we list every system it can read and every action it can take?
• Does a person approve any action that has meaningful consequences?
• Is there one named owner?
• Is there a defined spending cap and an alert or stop point?
• Can the owner stop new work now?
• Do we know what happens to unfinished work after a stop?

If any answer is unclear, keep the agent in testing. Clear limits make a smaller agent more useful than a broad agent nobody is ready to supervise.

Choosing the first task matters as much as setting the controls. Start with one person and one recurring task before you add more scope.