Falnor / Guides
agent guardrails: how to stop agents sending wrong invoices and other mistakes
The risk with an agent in operations is not that it is slow. It is that it acts confidently on bad data: an invoice for a service that was never provided, a payment to the wrong account, a customer told something untrue. Guardrails are the controls that make that unlikely and recoverable.
Book a discovery callWhy agents go wrong in operations
Agents fail in two main ways. They act on a wrong reading of a document or record, and they act when they should have asked. Both are made worse when the agent can write or delete in your systems without a limit.
The guardrails that matter
- Permissions per tool and per action: separate rights to read, write and delete, set for each system, so one mistake cannot spread.
- Read-only first: the agent shows what it would do on your real cases before it is allowed to change anything.
- Approval for anything hard to undo: payments, changes to bank details, customer-facing messages and deletions wait for a named person.
- Evidence on every decision: what it looked at, which rule it followed and where each value came from.
- A stop when unsure: if no rule fits or a value cannot be traced, the item goes to a person instead of being guessed.
- A record you can read: every action is logged so you can explain what happened and why.
How to test them before you trust an agent
Run the agent in shadow on a few weeks of your real work and compare what it would have done with what your team did. Count the cases where it was right. We use a bar of at least 9 in 10 on your own cases before it takes over a routine task, and it stays at read-only for anything it has not earned.
Where the person sits
The approval point depends on the cost of a mistake. Our guide to human-in-the-loop automation covers when a person should approve before the action and when monitoring after is enough. For finance, accounts payable automation shows the approvals in practice.
Questions people ask
What are agent guardrails?
They are the controls around an agent: permissions on what it can read, write and delete, approvals for important steps, a stop when it is unsure and a record of every decision.
How do I stop an agent sending a wrong invoice?
Hold every invoice for a named approver, check each value against its source, and keep the agent read-only until it has proved itself on your real invoices.
Should an agent be able to delete records?
Only where a deletion is easy to undo, and ideally not at all. Give delete rights per tool and per action, and hold anything irreversible for a person.
How do I know when an agent can act on its own?
When it has been right at least 9 times in 10 on your own cases for that one task, and the action is easy to undo. Everything else keeps a person in the loop.