In 30 seconds

Write down exactly which actions the AI may take, with their limits, and which it may not, ever. Keep this separate from what it is technically capable of. Allowed is a deliberate choice; capable is just what the system could do.

Why this comes up

An AI connected to a system can often do far more than its job requires. If you do not decide which of those possible actions are allowed, the effective answer is "whatever the model tries," which is how workflows acquire risks nobody chose.

Listing allowed and prohibited actions turns a fuzzy capability into a defined, testable boundary.

Separate allowed from possible

The first move is to notice the gap between what the AI can technically do and what it should be permitted to do. A tool that can update any field can technically delete data; that does not mean it may. Write the permitted set explicitly, and treat everything outside it as not allowed by default.

Define allowed actions with limits

For each allowed action, state its limits. Not just "can issue refunds," but "can issue refunds up to 100, for orders within 30 days, once per order." Limits, amounts, ranges, frequency, who it applies to, are what keep an allowed action safe. Pair each with an autonomy level: draft or execute.

Make prohibited actions explicit and enforced

Some actions should never happen. Name them clearly, and enforce them where it counts. A prohibition written only in the model's prompt is a request, not a limit. If an action must never occur, enforce it with a guardrail in the surrounding system, so the model cannot do it even if it tries.

A small example

An agent handled appointment changes. Allowed: reschedule within the next 30 days, into open slots, up to two times per booking. Prohibited and enforced: cancelling bookings, changing prices, contacting anyone not on the booking. The allowed set was small and limited; the prohibitions were guardrails, not polite instructions.

What this does not solve

Defining allowed and prohibited actions sets the boundary; it does not confirm the AI acts correctly within it. An allowed action can still be taken in the wrong situation. Combine this with validation, approval where costly, and testing of both allowed and prohibited cases. See the checklist before giving an agent write access.

Good enough to move on when

  • Allowed actions are listed, each with explicit limits.
  • Prohibited actions are named and enforced as guardrails.
  • Allowed is clearly separated from technically possible.
  • Each allowed action has an autonomy level.