AI agents cross a line that ordinary chat systems do not: they connect probabilistic decisions to real actions. An agent that can read mail, update a record, run a tool, or spend money is part of your production control plane. Prompt quality matters, but prompts are not a security boundary. The controls below should exist before an agent receives production access. 1. Separate read, recommend, and execute Do not treat "access" as a single permission. Use three distinct stag...