Blast radius
By the end: Bound what an agent can affect, so that a bad run is contained by design.
Assume a run will go wrong: a confused model, a bad tool result, a successful injection. The question is not whether, but how far the damage reaches. That reach is the blast radius, and it is a property of your design rather than of the model.
Scope credentials to the run. An agent handling one customer’s ticket should hold access to that customer, not to the customer table. Where your data layer can enforce that — row-level policies, scoped tokens, a service that only ever answers about one subject — the constraint holds even when everything above it is confused.
Sandbox execution. An agent that runs code needs a container with no network it does not require, a writable directory it cannot escape, and a time limit. An agent that browses should not share a session with the operator’s logged-in accounts.
Bound the volume. Most legitimate runs touch a few records; most runaway ones touch thousands. A per-run cap on writes, messages and spend converts a disaster into an incident with a clear log line.