CEO warns AI governance could spark fallout

Running AI agents with a limited blast radius

I built a synthetic‑voice podcast the night before a meeting, letting the AI narrate my company’s key performance indicators and media coverage while I rested in a taxi. The practice, I note, is not a sign of meticulous planning but an acknowledgement that most tasks assigned to the agent are reversible. “If something goes awry, the consequences are a wasted afternoon rather than catastrophic,” I write.

The 2026 AI Impact Survey found that 78 % of executives lack confidence they could pass an independent AI governance audit within 90 days. My own experience mirrors that figure; my organization could not meet the audit either.

In my view, a formal governance framework works for large enterprises, but lean teams often lack the resources to build one. Instead, I follow a simple rule: “Tell it to stop when it annoys me.” The principle rests on assessing whether a mistake is reversible.

Practical limits on what agents can do

One example involves connecting an AI agent to the customer‑support platform Intercom. The agent reads incoming tickets each day and compiles a report for me. Although the data is real customer information, the agent only reads and never writes back to the system, limiting risk to a potentially inaccurate summary that I would spot myself.

Read‑only access can become problematic when an agent parses email content. Malicious actors could embed instructions in a message that the AI interprets and executes—a technique known as prompt injection. My mitigation is to give the agent a dedicated email address and forward only vetted messages, reducing exposure to unsolicited commands.

Before granting any unsupervised capability, I ask a single question: “If it screws this up, can I undo it?” If the answer is a lost afternoon, the risk is acceptable. If the answer is irreversible damage, the task is off‑limits.

I once built a workflow that sent out emails faster than I could halt them. The messages were not offensive, but they were unintended. After that incident, I instituted a hard rule: the agent may not send any communication to a customer, partner, or external party without explicit human approval. Since then, no such messages have been dispatched.

Following the same logic, I advise against giving agents admin privileges on critical code repositories. A bad read is recoverable, but a bad write could introduce permanent defects or security holes.

Another concern is financial. Token pricing for large‑language‑model APIs remains low, but rates will rise, making runaway usage costly. An agent stuck in a loop can burn through thousands of dollars in API calls before the issue is noticed.