Four Controls That Turn an AI Agent From a Demo Into a System

A chatbot answers. An agent acts: it searches a document, fills in a form, drafts the reply and sends it. Because it acts, it needs rules before it needs features.

Two guides on AI agents published by Sifted in 2026, one sponsored by Box and one by Salesforce, collect the experience of companies that got past the pilot stage. Strip out the product names and the same four controls appear in both. Each one is a question you can put to any vendor, including us.

1. Scoped access, time-bounded, fully logged

The clearest version comes from Box's chief information security officer, Heather Ceylan: agents should never have broad standing access just because they are useful. Permissions should be scoped to a task, time-bounded where possible, and fully logged.

The question to ask: what exactly can the agent read and change, and who can see what it touched? If the answer is "everything", that is not an answer.

2. A second check

Agents make mistakes, and the guides say so plainly. One founder describes them as "well-intentioned, slightly forgetful children". The teams that got past the pilot all added a second step. Either a person approves before anything leaves the building, or a separate evaluator checks the first agent's work independently and scores its confidence.

One London company in the Box report, Deliverance, builds this in as a pair of agents: an executor that does the work and an evaluator that critiques it. Its founder's summary is worth borrowing: "It's not magic. It's a governed system."

The question to ask: what checks the output before a customer sees it?

3. Rules for when it does not know

A reliable agent knows when not to act. That matters more than being right most of the time, because an agent that recognises its limits does far less damage than one that is merely usually correct. The rules are written in advance: if it cannot find the source, it says so; if confidence is low, it asks a human; if money or an upset customer is involved, it escalates.

Then test exactly those cases. The tidy requests almost always work. The oddly phrased ones are where the failures are.

The question to ask: show me what it does with a request it cannot answer.

4. A log of every step

For each run: what the agent received, what it used, what it produced. When something goes wrong, the log tells you whether the input was bad, the instructions were unclear or a tool failed, instead of guessing. It is also what lets you answer, months later, where a particular answer came from.

The question to ask: if I pick any answer from last week, can you show me its sources?

What this means in practice

These are the rules we build to at Devaland. Our assistants answer from the client's own documents, cite the source behind every claim, and say plainly when they cannot find one. We do not present that as a guarantee. We present it as something you can verify yourself, on every single answer.

Sources

Sifted, "The rise of AI agents", June 2026 (sponsored by Box). Sifted, "The startup agentic AI playbook", August 2026 (sponsored by Salesforce).