Separate planning from acting
Let the model propose actions; execute only through a controlled tool layer with typed inputs and allow-lists.
Human-in-the-loop for irreversible steps
Refunds, emails to customers, and data deletes should require confirmation until trust is earned with metrics.
Audit every tool call
Store who/what/when for agent actions. When something goes wrong, you need a timeline—not a mystery.