The real danger of AI agents isn’t intelligence
Everyone’s excited about AI agents that can take actions, browse the web, run tools, automate work.
But intelligence isn’t the main risk.
Once an agent can act, permissions become the problem.
Prompt injection stops being theoretical when an agent can read an email and then send one, delete files, or touch money. Yet most systems today still follow the same pattern:
“Connect once → give full access → hope nothing goes wrong.”
We’re effectively rebuilding operating systems, except instead of humans clicking buttons, it’s an LLM deciding what to do next. I’ve been thinking about this a lot while working on an agent workspace (Elixa), and it feels like this layer is being massively underestimated.
The real question isn’t whether agents are useful.
It’s how much autonomy they should have.
Should agents be confirm-to-act by default (safer but slower),
or autonomy-first with guardrails (faster but riskier)?
If you could force one agent action to always require human approval, what would it be?
Sending emails?
Deleting files?
Payments?
One framing that’s been useful for me is separating specification from execution.
In many domains, the riskiest part isn’t deciding what should be done, it’s deciding when and how it actually happens. AI can be very good at helping specify intent, like surfacing options, defining constraints, and teeing up actions, while still keeping execution gated behind explicit human approval.
That’s already how high-risk systems like medicine work: software proposes, humans authorize. The system is optimized to reduce ambiguity and surface edge cases, not to act autonomously by default.
From that lens, the question isn’t “how autonomous should agents be?” but “which layers should never be autonomous?” Payments, irreversible deletes, and anything that touches capital or identity feel like obvious execution boundaries.
Curious whether others are thinking about agent design in terms of layers rather than autonomy vs guardrails.