The agent got the login on Monday. By Friday it had read the shared drive, drafted 3 customer emails and reorganised a folder nobody asked it to touch. Nobody can say which tasks anyone approved, because nobody wrote the job down. The tool used the access it was given, inside a role nobody defined. The fix takes 8 lines and 10 minutes, before the next login is shared.
The direct answer: before an AI agent touches your systems, write an 8-line job description that names its 1 task, the systems it may read, the systems it may change, a money limit of $0 CAD until a person raises it, the people it may contact, the shape of its output, the conditions that stop it, and the named person who reviews its work each week.
- The 8 lines, in order
- Why the default settings fail the office
- The weekly check that keeps the page alive
The 8 lines, in order
Line 1 states the job in 1 sentence. Draft replies to support tickets is a job. Help with support is a hope. Line 2 lists the systems the agent may read, by name. Line 3 lists the systems it may change, by name, and the list starts empty for any system that holds money, payroll or customer records.
Line 4 sets the money limit. The default is $0 CAD. An agent that cannot spend cannot create the refund, the order or the subscription that a person then has to unwind. Line 5 names the people the agent may contact, and everyone else is out of scope. Line 6 fixes the output shape: where finished work lands, and in what form a person reviews it.
Line 7 writes the stop conditions. A missing file, a conflicting record or a request outside the job ends the run and asks a person. Line 8 names the owner and the review day. The owner reads the run log, checks the outputs against the job and edits the page when the job changes. Your agent’s memory needs an editor, not a bigger limit makes the same case for what an agent keeps. This page governs what an agent may touch in the first place.
Why the default settings fail the office
A default is a decision someone else made for your firm. Vendor defaults favour a smooth first demo: wide access, quiet logging, no hard stop. Notion agent Memories are private to each user. Decide what they may keep shows how much a default can hold before anyone has made a call. Canadian privacy law keeps your firm accountable for what a tool does with personal information on your behalf.
Access creep starts small. One Claude Code setting leaked 1,379 passwords and keys. The check takes 10 minutes is the standing warning on this site about what 1 unchecked setting can expose. Six frameworks want to run your agents. Pick the one your team can run half-asleep covers the tool choice. The job description sits above the tool, and your firm owns it outright.
The weekly check that keeps the page alive
Print the 8 lines. Put the page where the team can see it. On the review day, the owner reads 3 things: the runs the agent stopped on, the outputs a person had to redo, and any access the agent asked for that the page does not grant. Each item earns 1 edit to the page or 1 clear decision to leave the page as it stands. A job description that never changes is a first draft, and the work will outgrow it inside a month.
The recap fits on the same page. 1 job, 2 access lists, a $0 CAD limit, a contact list, an output shape, a stop rule and a named owner. 8 lines stand between a helpful tool and an unaudited coworker with every password.
Write the 8 lines today for the agent your team uses most, before its next run, and read Your agent’s memory needs an editor, not a bigger limit for the memory rules that pair with them.
