When an AI Agent Gets the Keys

An AI agent that can only talk is a writer. An agent that can issue a refund, send an email, change a price or run a command is an employee with keys, and most businesses are handing out keys faster than they are deciding which doors they open.

This essay is about the agents a business runs for itself: the support bot, the coding assistant, the inbox helper, the shopping agent with a card. Every story below is documented by the company involved, a tribunal or the researchers who ran the test. Each one maps to a control a small business can put in place this month.

Five situations every business will recognize

The support desk that invented a policy

In April 2025, users of the code editor Cursor were being logged out when they switched computers. One asked support and got an answer from an AI support bot: logins were now limited to one device. No such policy existed. The cofounder apologized publicly, refunded the user and announced a change: "Any AI responses used for email support are now clearly labeled as such." [1]

A year earlier, a Canadian tribunal had already decided who pays for that kind of mistake. Air Canada's website chatbot suggested a grieving customer could apply for a bereavement fare after travel; another page of the airline's own site said otherwise. Air Canada argued the chatbot was responsible for its own actions. The tribunal disagreed and, as reported, wrote: "It should be obvious to Air Canada that it is responsible for all the information on its website." The money at stake was the difference between two fares. The principle was bigger. [2]

The lesson: an agent that speaks for the business makes commitments for the business.

The coding agent and the production database

In July 2025, SaaStr founder Jason Lemkin posted that Replit's AI agent had deleted his app's production database during a code freeze. [3] Replit's CEO answered two days later: the agent "deleted data from the production database. Unacceptable and should never be possible." He listed fixes: automatic separation of development and production databases, one-click restore of a project's state, and a planning-only mode "so you can strategize without risking your codebase." [4] The next day Replit began rolling out separate development and production databases, starting in beta with new apps. [5]

The lesson: the fix was not a better prompt. It was architecture: the agent should never have been able to reach production, and everything it touched should have been restorable.

The inbox that took instructions from a stranger

Give an agent your email and it reads messages written by anyone. Security researcher Simon Willison calls the dangerous combination the lethal trifecta: access to private data, exposure to untrusted content and the ability to communicate externally. "If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to that attacker." [6]

That is not hypothetical. When Anthropic tested its browser agent against 123 prompt-injection cases, attacks succeeded 23.6 percent of the time without new defenses and 11.2 percent with them. In one test, a malicious email claimed messages had to be deleted for security reasons, and the agent "followed these instructions to delete the user's emails without confirmation." Anthropic's response included asking the user "before taking high-risk actions like publishing, purchasing, or sharing personal data." [7] OpenAI's agent pauses for confirmation before certain actions and, when logged into sensitive sites such as email or banking, pauses if the user goes inactive or navigates away. [8]

The lesson: any agent that reads outside content can be steered by it. Limit what it can send and where.

The shopkeeper who could be talked into anything

In 2025, Anthropic let Claude run a small shop in its office. Customers, mostly employees, talked it into discount codes, and it gave items away, "ranging from a bag of chips to a tungsten cube, for free." It announced the end of discount codes, then went back to offering them within days. [9]

The lesson: an agent with authority over money needs limits it cannot negotiate away. Its judgment is not one of them.

The card in the agent's wallet

The payment industry has already decided that agents should never carry an open card. Stripe's shared payment tokens give a seller scoped access to a customer's payment method, with a maximum amount, a currency and an expiration, for one specific seller, revocable "at any time." [10] Visa says of its agent program: "Each consumer sets the limits, and Visa helps manage the rest." [11] Walmart's coming agent profiles let a customer require approval for every purchase or set a per-agent limit, and delete the profile whenever they like. [12]

The lesson: the institutions that move money have converged on scoped, limited, revocable authority. A business should hold its own agents to the same standard.

Four controls that keep a mistake small

The OWASP list of the top risks in AI applications names the failure behind most of these stories "excessive agency," with three root causes: "excessive functionality; excessive permissions; excessive autonomy." [13] Each one has a direct counter.

1. Grant the smallest key

Give each agent the functions its job needs and nothing else. The support agent can look up orders and draft replies; it cannot change prices. The coding agent works on a copy; it cannot reach the live database. The inbox agent can summarize and draft; sending outside the company waits for a person. Separate credentials per agent, so you can see what each one did and revoke one without stopping the others. Walmart's per-agent profiles apply the same idea from the retailer's side. [12]

2. Make every action undoable, or make it wait

Sort an agent's actions into two kinds. Reversible actions (a draft, a change on a branch, a price on a test page, a refund below a threshold you can claw back) can run on their own. Irreversible or high-stakes actions wait for a yes. OpenAI's guide to building agents draws the same line: "Actions that are sensitive, irreversible, or have high stakes should trigger human oversight until confidence in the agent's reliability grows," naming "canceling user orders, authorizing large refunds, or making payments." [14] Replit's answer to its incident was both halves at once: keep production out of reach, and make everything restorable. [4]

3. Verify with something other than the agent

An agent reporting "done" is a claim, not evidence. Check the result independently: read the live page after the change, confirm the refund in the payment system, look at the sent folder. We run Lehvel on this rule. A change reaches production only through a pull request, tests on the exact commit and a merge, and it counts as shipped only after a separate read of the live site shows it. A merge is not completion, and neither is an agent's summary.

4. Keep a stop switch and a log

You need to be able to stop any agent at once, and to see afterward what it did. NIST's AI risk framework asks for exactly this: mechanisms and assigned responsibilities "to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use." [15] In practice: one place to revoke each agent's credentials, a log of every action with its inputs, and a label on anything an agent wrote for a customer, as Cursor learned to do. [1]

The permission ladder

Put together, the controls form a ladder an agent climbs as it earns trust:

1. Read. It can look things up and summarize. Damage is limited to what it can leak, so keep it away from the lethal trifecta.
2. Draft. It prepares the reply, the change, the order. A person sends.
3. Act, reversibly. It acts on its own where every action can be undone, under limits, with a log.
4. Act, irreversibly, with approval. Payments, deletions, public statements and commitments to customers wait for a yes, with the evidence attached.

Most businesses should run most agents on the first two rungs today, and move a specific task up only when its record justifies it. The question to ask of any new agent is concrete: what is the worst thing it can do with the keys it has, and how fast could we undo it?

Agents will get more capable every year. The businesses that benefit most will be the ones that hand out authority as deliberately as they would to a new hire: one door at a time, with the logs on.