How to run AI agents safely at work: a plain checklist (2026)

This week’s launches had a clear theme: agents are getting their own computers and their own keys. NVIDIA OpenShell and Google Agent Compute Engine give each agent an isolated place to run. 1Password for Agents lets an agent log in without seeing a password. And the most-discussed security story on Hacker News (CSO Online) argued that recent incidents were containment failures, not rogue AI.

You don’t need to understand the infrastructure. You need to ask the right five questions. Here they are. (This is a spin-off of our trending AI agents roundup; see the latest week on the trending hub.)

1. Where does the agent run?

An agent that reads files or runs code should run somewhere separate from your laptops and servers: a sandbox, container or per-agent virtual machine. If it gets confused or tricked, the damage stays inside that box.

Ask your builder: “Is each agent isolated, and what can it reach on the network?”

2. What is it allowed to touch?

Give the agent the smallest set of tools and data the job needs. A lead-research agent needs to read your CRM and write notes, not delete contacts or send email. The OWASP Top 10 for LLM apps calls this “excessive agency”, and it is the most common mistake.

Ask: “List every tool and permission the agent has. Why does it need each one?”

3. How does it log in?

Never paste passwords or long-lived API keys into a prompt. Better options, in order:

1. The agent has its own account with limited rights.
2. It uses short-lived credentials that expire (what Google’s new service does).
3. A password manager fills logins after a person approves (1Password for Agents).

4. When must a person approve?

Make approvals the default for anything that can’t be undone: payments, emails to customers, deleting or exporting data, changing permissions. Zapier’s new AI by Zapier step has per-tool approvals built in; n8n can do the same with a wait-for-approval step.

5. Who reads the log?

Every action should be logged with what the agent saw, what it decided and what it did. Then someone should actually look, at least weekly at first. Trail of Bits showed how coding agents quietly change more than they were asked to; logs are how you catch that.

A one-page checklist

Check	Good answer
Where it runs	Isolated sandbox or VM, limited network
Permissions	Only what the job needs, listed in writing
Logins	Own account, short-lived keys or password manager
Approvals	Required for money, customer messages, deletes
Logs	Every action logged and reviewed weekly
Testing	Tried on 20–50 of your real past cases first

For a broader framework, the NIST AI Risk Management Framework is free and readable.

Related workflows

• AI support agent with actions: a support agent that can do things, with approvals.
• Trust and safety review agent: flags risky content or actions for a person.
• Autonomous support agent system: the bigger version, with guardrails.