Why instructions are not restrictions
Telling an AI “do not send emails” or “do not look at payroll” in a prompt is guidance, not a control. Models can misunderstand instructions, and text in a document or email can try to override them. Real restrictions are enforced by the system the AI calls, which refuses the request regardless of what the AI was told.
So the practical question is: at the point where the agent reaches your data and systems, what is it allowed to do?
The four axes of restriction
1. Data. Which systems, records and fields can the agent read? A client-reminder agent needs client status and contact details. It does not need payroll, board papers or other clients’ files.
2. Actions. What can it do, beyond reading? Creating a draft, updating a task, raising an invoice and sending an email are different actions with different consequences. List them separately and allow each one deliberately.
3. Principal. Whom is the agent acting for? An agent acting for a junior member of staff should not reach what a partner can reach. The agent’s access should never exceed the access of the person it acts for.
4. Approval. Which actions need a person to decide first? External communication, financial changes and publication are common candidates.
Practical techniques
- Least privilege. Start with read-only access to one system and add from there.
- Named actions, not raw access. Give the agent specific operations, such as “create draft reminder”, rather than full API access to a mailbox.
- Scoped credentials. Where you must issue credentials, limit their scopes and lifetime.
- Per-client or per-project boundaries. Bind a piece of work to the entity it concerns.
- Rate and volume limits. Cap how many actions an agent can take in a period.
- Time limits. Grant access for a task or a period, not forever.
- Refusal records. Log what was denied as well as what was allowed. Denials show you where the rules are being tested.
A worked example
A London accountancy practice wants AI to chase clients for year-end records.
| Allowed | Not allowed | |
|---|---|---|
| Data | Client status, outstanding items, contact details | Payroll, AML notes, other clients |
| Actions | Create Outlook draft | Send email, change records |
| Acting for | The manager responsible for the client | Anyone else |
| Approval | Manager reviews each draft | — |
Review regularly
Restrictions drift. New connectors are added, people change roles and agents get new jobs. Review what each agent can do on a regular schedule, and whenever its purpose changes.
How Kroy approaches it
Kroy enforces restrictions at the point of action. Every request is checked against the person, the agent, what the person has delegated to that agent, the organisation’s policies and any approval requirement. Skills package a business job with exactly the data and actions it needs, so an agent is given a job it is allowed to do rather than open access. Give AI capabilities, not unrestricted access.