Read-Only by Default: Guardrails for AI Agents That Touch Enterprise Data
The fastest way to lose trust in enterprise AI is one bad answer or one unauthorized action. A practical checklist for connecting agents to real data without creating a new risk surface.
Connecting an AI agent to enterprise data is easier than ever. That's exactly why it deserves some care.
An agent with data access is a new kind of user: tireless, fast, literal and occasionally overconfident. The good news is that the controls it needs aren't exotic. Most of them are data governance basics, applied consistently to a new consumer.
Here's the checklist I use.
1. Start read-only
The majority of high-value agent use cases (answering questions, summarizing trends, modeling scenarios, drafting reports) only need to read data. Ship those first. Add write actions later, one at a time, each with a clear owner and an approval step.
2. Inherit the user's permissions
Avoid a shared, all-powerful service account. Instead, have the agent ask the user to authenticate (OAuth works well), so every query runs with that person's existing access. The agent can never reveal more than the user could already see, and your existing row-level security keeps working.
3. Narrow tools beat open-ended ones
A run_any_query tool is convenient and dangerous. A handful of purpose-built tools, like "get this metric," "compare these periods" or "model this scenario," limit what can go wrong and make the agent more accurate at the same time.
4. Keep humans on the consequential decisions
Let the agent draft, recommend and prepare. Let a person approve anything that changes a record, sends a message or commits money. "Human in the loop" isn't a lack of ambition. It's how you earn the trust to automate more later.
5. Make every answer traceable
Log the question, the tool calls, the parameters and the data returned. When a leader asks "where did this number come from?", you should be able to show them in seconds.
6. Test like you mean it
Maintain a set of real questions with known correct answers and run it on every change: to prompts, tools, models or data. Track accuracy over time. A model upgrade that changes answers silently is a regression, not an improvement.
7. Mind the sensitive fields
Some data should never reach a model, or should only reach it aggregated. Decide which fields are masked, aggregated or excluded before you build the tools, not after someone notices.
8. Tell users what the agent can't do
Clear scope builds confidence. A short note like "I can analyze cost and budget data; I can't see individual customer records" prevents misunderstandings and sets expectations.
Guardrails aren't what slow AI adoption down. Losing trust is. Guardrails are how you keep it.
None of this is glamorous, and that's the point. The organizations moving fastest with AI agents are the ones that made the boring parts boring: governed access, clear definitions and good logs.