Checklist
Bound how much damage one agent run can do
Automation turns one mistake into throughput unless you design a brake.
When it fits
- An automated agent can repeat actions quickly or affect many records before a person notices.
When to avoid it
- Rate limits and stop controls reduce blast radius; they do not substitute for correct permissions, validation and approval.
Checklist
- One run has an explicit maximum action or resource scope.
- Unusual action rates can be detected or stopped.
- A human can halt or suspend further actions.
- High-impact batches are split or sampled before full execution when practical.
- Rollback or compensating action is documented where available.
Why it matters
Set limits on action count, affected resources, spend or batch size that match the task. Add a visible stop path for behavior outside expectations and make recovery possible where the downstream system supports rollback. The aim is not to make bad actions acceptable; it is to prevent one error from scaling silently.
An example
An agent updating customer records first changes a small bounded batch and pauses on error-rate thresholds instead of editing the full database in one pass.
Check your result
You can state the maximum plausible effect of one unreviewed run under the configured controls.
Keep this limit in mind
- Rate limits and stop controls reduce blast radius; they do not substitute for correct permissions, validation and approval.
Connected ideas
Useful withPut approval immediately before the high-impact actionUseful with
Monitor the agent after deployment
Evidence and sources
OWASP recommends rate limiting to reduce the number of undesirable agent actions, while NIST safety guidance includes the ability to shut down, modify or intervene in systems that deviate from expected behavior.
A rate cap and stop path limit damage; they do not make an unsafe autonomous action acceptable.
LLM06:2025 Excessive Agency · Damage-limitation controls: rate limiting