Four safeguards to stop your AI agents from going rogue

Intelligence is advancing faster than organizations can safely deploy it, wrote Amit Zavery, president, chief product officer and chief operating officer of ServiceNow, in a SiliconANGLE opinion piece. The core problem, he argues, is providing enough context and controls to ensure an agent produces accurate results and doesn't overstep its bounds.

Zavery proposes an architectural framework with four characteristics: sense, decide, act, and secure. These are meant to convert the probabilistic outputs of an AI system into verifiable decisions a business can trust.

Sense refers to keeping the agent's view of business data current. An agent is only as reliable as the information it works with. If a policy changes, a system goes down, or a customer's status shifts, and that update doesn't reach the AI in time, every downstream decision will rely on outdated facts. This requires connecting to data across departments, systems, and clouds, and treating that data as a live signal rather than a snapshot.

The second safeguard, decide, grounds the agent in an organization's own decision history and policies, not just its live data. An agent handling a routine request should have access to how the last 20 similar requests were resolved. Zavery points to the Meta incident, where an internal agent gave flawed technical guidance that led to data exposure; better context from similar historical changes might have avoided it.

The third, act, means agents should execute, not just advise. Coordinating several agents into a workflow requires passing context between steps, applying consistent policy at each stage, and staying in sync with underlying system changes, all while maintaining governance that keeps agents from acting outside their lane.

The fourth safeguard is security. Autonomous tools need the same access discipline applied to employees: scoped identity, permissions limited to the specific task, and a clear audit trail. In the Instagram incident, tighter scoping and a real-time check on what the bot was authorized to do might have caught the error. Every agent needs a permission set tied to its role, logging of every action, and a kill switch to cut off access the moment something goes wrong.

Zavery stresses that none of this detracts from the capabilities of modern models, which are advancing rapidly. The hard part, he says, is connecting intelligence safely to a business—its systems, rules, and history of what worked and what didn't. Sense, decide, act, and secure are how you get there safely.