Least privilege for a thing that can improvise
Every security model we've built for automation assumed the automated thing does exactly what it was programmed to do. A script runs its script. A pipeline runs its steps. The behavior is bounded because the code is bounded. An AI agent breaks that assumption on purpose. Its entire value is that it decides its own next step. Which means the old question "what will this do" has been replaced by "what could this do," and that's a much larger, much scarier surface.
So I stopped trying to predict agent behavior and started containing it. You cannot enumerate everything a reasoning agent might attempt. You can absolutely bound what it's able to attempt. That's the whole game.
Contain the blast radius, not the behavior
Run it in a box that assumes it's hostile. Not because the agent is malicious, but because the agent can be convinced. A poisoned document, a cleverly worded input, a tool result that carries an instruction. Prompt injection is just the new word for "untrusted input reaching a privileged executor," and we have decades of practice with that: isolate the executor. An agent that touches untrusted content runs sandboxed, with no ambient credentials, no host access, and egress it can't widen on its own.
Give it the least privilege that lets it do its job, and not one grant more. The instinct is to hand an agent broad access so it can "figure things out." That instinct is how you build a very smart thing with the keys to everything. Scope every credential to the narrowest role. An agent that only needs to read should hold a token that can only read. When it inevitably does something you didn't anticipate, the credential is the wall that decides how far the surprise travels.
Separate the thing that reasons from the thing that acts. The model can plan freely. Planning is cheap and reversible. The execution of anything consequential goes through a narrow, audited, permissioned path that doesn't care how confident the plan was. Reasoning is unbounded; action is on rails. That split is the load-bearing wall of every agent I'd let near production.
Why this is a features problem, not a fears problem
People hear "sandbox the agent, scope its creds, gate its actions" and think it's about distrust. It's the opposite. It's what lets you give an agent real, useful autonomy without lying awake about it. The containment is what makes the capability safe to grant. You can hand a well-boxed agent surprising amounts of latitude precisely because you've made the worst case survivable. Freedom inside a safe boundary beats caution with no boundary at all.