Permissions and Limits: Deciding What Your AI Agent Can Do
An AI agent should only do what you've explicitly allowed. Here's how to scope its power.
The most dangerous phrase in AI support is "let it figure out what to do." An agent with open-ended power will eventually do something you never intended — at a scale and speed that makes it expensive. The fix isn't a smarter agent. It's a smaller one: an agent that can do exactly what you allowed and nothing more.
Getting AI agent permissions right is mostly a question you answer once, carefully, instead of cleaning up forever. Here's how to scope its power.
Start AI agent permissions with an allow-list
The default posture should be that the agent can do nothing until you say otherwise. Then you enumerate the specific actions it's allowed to take. This is an allow-list, and it's the opposite of how most teams think about it — they imagine restricting a powerful agent, when they should be granting a powerless one.
Write the list explicitly. The agent can:
- Issue a refund
- Update a shipping address
- Resend a receipt or invoice
- Reship a damaged item
- Apply a pre-approved discount code
And it cannot do anything not on that list. There's no "and use judgment for the rest." If a situation calls for an action you didn't list, the agent stops and gets a person. An allow-list fails safe by default: the things you forgot to think about are forbidden, not permitted.
An agent with open-ended power will eventually do something you never intended — at a scale and speed that makes it expensive.
Put a ceiling on consequential actions
Permission to do something isn't permission to do it at any size. The classic example is refunds: you might let the agent refund up to a set amount on its own, and require a person above it. The ceiling is where most of your real control lives.
Set a ceiling on anything that costs money or can't be easily undone:
| Action | Suggested ceiling | Above the ceiling |
|---|---|---|
| Refund | A fixed dollar amount you're comfortable losing on a mistake | Person approves |
| Discount / credit | A percentage or dollar cap | Person approves |
| Reship | One replacement per order | Person approves a second |
| Plan change | Downgrades only | Upgrades and cancellations to a person |
The right number is the one where a wrong action is annoying but not damaging. You can always raise it later, once the receipts show the agent earns it. Starting low costs you a few extra handoffs. Starting high costs you a bad week.
Require approval where it counts
Some actions shouldn't have a ceiling at all — they should always have a person. These are the irreversible and the high-blast-radius ones, where the downside isn't measured in dollars but in trust.
Require explicit human approval for:
- Anything irreversible. Account deletion, cancellations, data removal. If you can't easily undo it, a person signs off.
- Anything that affects many customers. A change that touches a batch, not one person, gets human eyes first.
- Anything outside the agent's domain. Legal, billing disputes, account security — judgment calls that need a person.
The pattern here is the same one that makes the whole system safe: the agent proposes, a person disposes. The model can suggest the cancellation; a human decides whether it happens. That split means the agent's power tops out exactly where you set it.
Rate-limit so one bug can't cascade
Permissions and ceilings govern individual actions. You also need a limit on the aggregate, because the failure mode that hurts most isn't one wrong refund — it's a bug or bad pattern issuing a thousand of them before anyone notices.
A rate limit caps how much the agent can do in a window: so many refunds an hour, so many credits a day. If it hits the cap, it stops and alerts you. This is your circuit breaker. It turns a runaway loop from a disaster into an alert. Set it generous enough not to interrupt normal volume, but tight enough that an anomaly trips it fast.
Tighten or loosen with evidence
Permissions aren't set once and frozen. They move — but only on evidence, never on faith. Every action leaves a receipt, and the receipts tell you whether the agent has been right inside the limits you set.
When weeks of clean receipts show the agent handling refunds well under a $50 ceiling, you have a reason to raise it. When an audit catches a pattern of bad discounts, you have a reason to lower the discount cap or pull it onto the approval list. The limits become a dial you turn based on proof, expanding autonomy where the agent has earned it and contracting it where it hasn't.
Where BearScope fits
BearScope makes permissions explicit and enforced. You define the allow-list of actions, set value ceilings, require approval per action type, and rate-limit the aggregate — and the agent proposes while your rules dispose. Every action leaves a receipt, so you can expand or tighten limits on evidence instead of hope. See how it works in the product overview, check what your plan includes on the pricing page, or book a walkthrough.
See it on your own conversations.
Bring your busiest day. We'll score every conversation in it.
Book a walkthrough →