An AI agent does more than answer questions. It decides on steps and uses tools: querying a database, calling an API, drafting and sending a message. That is what makes agents useful, and it is also what makes them risky. Putting one into an enterprise takes more than a good prompt.
The risks are specific
OWASP’s work on risks for LLM applications lists several that bite hardest with agents. Prompt injection, where hidden instructions in content hijack the agent, becomes more serious when the agent can act. Excessive agency, where an agent has more functionality, permissions or autonomy than its task requires, is a risk category in its own right. Sensitive data exposure matters whenever an agent can read broadly.
A practical checklist
Scoped identity. Give each agent its own identity with only the permissions its task needs. Do not reuse a shared administrator key.
Controlled tool use. Expose an explicit list of tools, validate inputs and outputs, and apply policy checks before an action runs. High-impact actions, such as payments or external messages, need an approval step.
Grounded knowledge. Retrieve from approved content, respect existing permissions and show sources.
Evaluation before release. Test on realistic and adversarial cases: task completion, accuracy, behaviour under injection attempts and what happens when a tool fails. Repeat after every change to prompts, tools or models.
Human oversight. Decide where people review, approve or take over, and make escalation easy. Autonomy can be widened as evidence builds.
Observability. Trace each run: inputs, tool calls, outputs, cost and latency. If you cannot explain what an agent did, you cannot defend it.
Operations. Name an owner, set budgets and rate limits, and plan for rolling back.
Platform support
Managed services help with several of these. Amazon Bedrock AgentCore, for example, provides building blocks for running agents, connecting them to tools, managing their identity and observing them, and Amazon Bedrock Guardrails helps filter unsafe content. Services do not replace design decisions, but they reduce what you have to build.
Why it matters
Gartner predicts that over 40% of agentic AI projects will be cancelled by the end of 2027, citing cost, unclear value and inadequate risk controls. The projects that survive will be the ones that treat reliability and control as part of the product.