Research edition · 14 September 2026
The report’s observations, prices and forecasts are a dated snapshot. Examples of savings are estimates unless explicitly identified as study results. This is not a fresh verification of every claim.
| Capability | Example | Default approval posture |
|---|---|---|
| Read a document and summarize | Meeting notes, policy summary, contract outline | No approval for low-sensitivity material; review before consequential use |
| Search private data | Find a policy in Drive, SharePoint, Slack, or CRM | Permit only within existing user permissions; log source citations |
| Create a draft | Email, report, presentation, code change, support reply | Human review before external or high-stakes use |
| Create a task or calendar block | Turn a meeting decision into a task or focus block | Allow with undo, owner, due-date preview, and notification controls |
| Update a record | CRM field, project status, spreadsheet row | Allow in low-risk fields with validation and audit log; approval for financial/legal/customer-impact fields |
| Send an email or message | Follow-up, support answer, internal announcement | Require approval for external recipients, commitments, sensitive data, or mass sends |
| File an expense or submit a form | Expense coding, invoice routing, procurement request | Require policy validation and approval before submission or payment |
| Change permissions or share content | Add a user, publish a doc, expose a dashboard | Human approval always; privileged action must be separately authenticated |
| Delete or overwrite data | Delete files, cancel meetings, change orders, modify code | Human approval, dry run, reversible operation, and audit log |
| Make a high-stakes recommendation | Hiring, lending, health, legal, disciplinary, safety | AI may assist retrieval or draft analysis; qualified human makes the decision |
Agent safety principles
- Least privilege: expose only the tools and records required for the job.
- Separate read and write credentials: an agent that can search does not automatically get send, delete, or payment rights.
- Treat external content as untrusted: emails, websites, PDFs, calendar invites, and tickets can contain prompt injection.
- Use structured tool schemas: restrict fields, enums, ranges, recipients, and allowed domains.
- Preview before side effects: show the exact proposed message, record change, or transaction.
- Idempotence and deduplication: retries must not send twice or create duplicate records.
- Budget and rate limits: cap tokens, credits, API calls, records, and time per run.
- Audit every action: log the user, agent, model, inputs, sources, tool calls, outputs, approvals, and result.
- Design for interruption: agents must stop safely when a source is unavailable, confidence is low, or a policy is ambiguous.
- Evaluate in the real environment: synthetic benchmarks do not replace tenant-level tests with actual permissions and data.
OWASP lists prompt injection as a primary risk for LLM applications and emphasizes that natural-language instructions and data are difficult to separate reliably.[45] Google’s secure-agent guidance advocates defense in depth that combines traditional deterministic controls with model-based defenses.[46]