How much guardrail does your AI agent need? What leaders must be able to defend

This post introduces the concept of 'guardrail risk tiering' for AI agents, a system for matching the depth and placement of runtime controls to an agent's data access, tool permissions, action authority, and potential consequences. It outlines a tiered approach (Baseline, Elevated, High Impact) with corresponding recommended guardrail depths, emphasizing the need for deterministic enforcement of hard business constraints outside the model for high-impact actions. The post also details the creation of a governance record to document an agent's risk tier, controls, and rationale, enabling leaders to defend their decisions to boards, auditors, or regulators. This contributes to the ongoing evolution of agent governance by providing a structured framework for risk assessment and control allocation.