How to stay in control of AI agents

In What is an AI agent? we described an AI that plans, acts and checks its own work. Once it does more than you can watch, you stay in charge before the run starts. You decide what the agent can reach, what it must ask about, what it can never do and how it shows the work is done.

We use Claude Code for the examples. The same ideas apply to other agentic tools, such as OpenAI's Codex, GitHub Copilot and Google's Gemini CLI, which have their own settings for what the agent may do without asking.

Why approving every step stops working

Once the same approvals keep coming back, it is easy to click yes without reading.

Anthropic's study (Measuring agent autonomy) found that experienced users approve less step by step and step in more often. On complex tasks, Claude stops to ask more than twice as often as people interrupt it.

Give the agent more room one task at a time.

• Approve each step on a new task to learn what the agent does not know about your work.
• Move the check from each step to each result, then to a sample.
• Write every correction into the agent's instruction file, such as CLAUDE.md, so the next run needs less of you.

How much room you give depends on the stakes. The more people rely on the result and the harder it is to undo, the closer you stay.

Keep the blast radius small

Blast radius is how much can go wrong if the agent makes a mistake or is tricked into one. Treat the agent like a new colleague. On day one they get access to what the job needs, not the whole company drive.

• Work on a copy. Give the agent copies of the files it needs, as in An agent in a folder, and keep the originals out of reach.
• Give it its own account with only the access the task needs.
• Turn on the sandbox in Claude Code. The agent's commands can then change files only in the folders you work in, and reach a new website only after it has been approved, by you or, in Auto, by the checking model (sandboxing).

A web page or an email can hide text that tries to steer the agent. This is called prompt injection. You cannot always keep an agent away from such content, but you can make the damage smaller. When an agent reads web pages or email, make it ask before it sends or deletes anything (Anthropic Help Center).

In Claude Code the folder you choose is where the agent works, not a wall. It can read files outside it, and asking it not to is no guarantee. Ask what it can reach before the first run.

Only a setting turns it into a firm block. In Auto, Claude Code asks the first time it reads outside the folder whether to block it from then on (permissions). Cowork keeps to the folders you connect.

YouCopy

Which folders can you read and which can you change? Then set it up so you cannot read or change anything outside this folder, and tell me what you changed.

The lethal trifecta

Simon Willison, a developer who co-created the Django web framework and gave prompt injection its name in 2022, describes the lethal trifecta. An agent becomes dangerous when it has three things at once.

• Access to private data, such as your files, email or CRM.
• Exposure to content you do not control, such as a web page or an email that can hide instructions.
• A way to communicate externally, such as email or a web request.

With all three, a hidden instruction can make the agent send your data to someone else. His advice is to never give one agent all three. Check every new agent and every new connector against the list before you switch it on.

Set permissions for each connector

A connector lets the agent read and act in another system, such as email, a CRM or a shared drive. It works with your own access in that system, so it reaches only what your account can reach. A connector that logs in with one shared account reaches whatever that account can see (Anthropic, connectors).

• Set each tool. In the Claude apps, a connector's tools are grouped into read-only tools and tools that write or delete. Each can be set to Always allow, Needs approval or Blocked (Anthropic, connectors). Keep sending on Needs approval, block deleting, and allow a tool always only if you trust it to run unwatched.
• Check the access. Read what it asks for before you approve, and disconnect what you no longer use.
• Trust the maker. A connector from an unknown source can hide instructions, and its maker can change how a tool behaves after you add it (Anthropic, custom connectors). The same goes for plugins and skills from others.
• In Claude Code a connector is called an MCP server, and the same rules can allow, ask about or block a whole server or a single tool (Anthropic, permissions).
• On Team and Enterprise plans an owner switches each connector on for the company and can limit what it may do, and members cannot override that.

Choose a permission mode

Claude Code offers five permission modes in its mode picker, best read by how often the agent stops to ask you (Anthropic, permission modes).

In the terminal and in VS Code, it starts in Auto. Reading and editing files in your folder go ahead, and a separate model checks the riskier steps instead of you. Anthropic writes that this does not guarantee safety.

The other tools offer the same range, from asking before every step to approving everything (Codex, Copilot in VS Code, Gemini CLI). Copilot's cloud agent also works on its own branch and waits for a person to merge.

Whatever the tool or mode, sort actions into three groups (Anthropic, Trustworthy agents in practice).

• Always allow what is easy to undo, such as reading and drafting in the folder.
• Ask first for anything that leaves under your name, cannot be undone or carries a client's name or number.
• Never for what must not happen at all, such as deleting the originals.

Hard stops and undo

A line in an instruction file such as CLAUDE.md is guidance, and the agent can miss it on a long task. Claude Code enforces a rule or a hook even when the agent forgets. An instruction is a request, and a lock holds.

Anthropic advises a hook, a deny rule or a managed setting for anything that has to happen every time (best practices). A deny rule blocks an action in every mode.

For everything else, make it easy to go back. Press Esc twice to rewind your files and the conversation to an earlier point. It does not undo anything sent or done outside your files, and Anthropic says it does not replace version control (checkpointing).

What a hook is

A hook is a small script that Claude Code runs by itself at a fixed moment in the agent's work, every time, whatever the agent thinks (hooks). Think of it as a smoke alarm. Nobody has to remember to switch it on.

The agent is non-deterministic, so the same instruction can lead to a different step next time. A hook is deterministic. Deterministic and non-deterministic AI explains why that matters.

You do not have to write one yourself. Describe the rule in plain words and Claude Code writes the hook. Codex and Gemini CLI have hooks too.

YouCopy

Add a hook that stops any step that sends an email or deletes a file, and tell me what it blocks.

Let it run on its own, safely

Two Claude Code commands keep it working without you. /loop repeats a task at intervals while the session stays open, such as checking a folder for new notes (scheduled tasks). /goal tells Claude what done looks like, and it keeps working turn after turn until it gets there (goal). Codex has a goal command that works the same way (Codex).

After each turn a separate small model checks whether the goal is met. It cannot open files or run anything and judges only what Claude has shown, so ask Claude to show its check.

Scheduled tasks can also run in the cloud with your laptop closed (routines).

• Set a cap in every goal, such as "or stop after 20 turns", since there is no built-in limit.
• Press Esc to interrupt, and Claude keeps the work done so far. Type /goal clear to end a goal, and ask Claude to cancel a loop.
• Read the run, then approve. A person sends or publishes the result.

Make it check its own work

When you did not watch the run, the check is how you know the work is right. Three habits make it worth trusting.

• Define done before the run. Afterwards it is easy to accept whatever came back.
• Give it a check that passes or fails, something it can run, as Anthropic advises (best practices), such as a script that confirms the totals add up (why scripts help).
• Let a second agent review in a fresh session, without the first agent's reasoning.

Take a monthly report. One agent drafts it, a second checks it against your rules, a third tests every number against the source, and nothing goes out until a person approves it.

Three ways to hand work over

Addy Osmani, an engineer at Anthropic who writes widely about working with AI agents, including Anthropic's guide to Opus 5.5, points to a paradox in Critical thinking when agents do the work. The better the agent gets, the fewer obvious errors you see, and the less you check. Over time you go from reading each answer to accepting it.

The last step has a name, cognitive surrender, coined by Steven Shaw and Gideon Nave at Wharton (paper). Four questions keep you on the first step before you sign off.

• What did the check prove?
• What did it not check?
• What did it decide for me?
• Can I explain the result?

You may offload the work and much of the auditing, but not the accountability.

Addy Osmani

Where to start

Pick one task you already give an agent, and set it up this way.

• One task with a clear result.
• A small folder with copies of what it needs.
• A mode that fits how often you want to be asked.
• One rule that blocks the step that must never happen.
• A clear goal with a cap, and a check that passes or fails.

For leaders. In Claude Code, IT can set managed settings for the whole company that users cannot change (Anthropic, settings). They can switch off the two modes that ask least and enforce the same rules and hooks for everyone.

When one agent runs safely, How to build a team of AI agents shows how to add more.