Start with a draft-only permission model, where the agent can prepare output but cannot execute external write actions. This limits blast radius, preserves user trust, and makes mistakes reversible before anything leaves the system. Teams should also require human approval for each escalation path, then expand permissions only after repeated correct behavior and clear value delivery.
Why Draft-Only Is the Right Default for AI Agents
Teams implementing AI agents should treat message drafting as a low-risk capability and external action as a separate, higher-trust privilege. That distinction matters because autonomous systems do not follow human-style, predictable workflows. Once an agent can write to email, chat, ticketing, CRM, or support systems, a small prompt injection or bad tool call can become a real-world action. NHIMG’s coverage of the AI Agents: The New Attack Surface report shows why this is no longer theoretical.
Industry guidance is converging on the same principle: draft output can be generated with far less blast radius than action execution, but current guidance suggests teams should still assume the draft may be manipulated, misleading, or socially engineered. That is why draft-only permissions should be paired with explicit approval gates before any send, post, update, or delete operation. The risk is not just accidental damage. It is also unauthorized privilege chaining when an agent is allowed to call downstream tools after content creation. For deeper threat patterns, see the OWASP Agentic AI Top 10.
In practice, many security teams discover that “helpful drafting” becomes “silent execution” only after an agent has already sent something inappropriate or touched a connected system.
How to Build Draft-Only Controls Without Blocking Productivity
The safest pattern is to separate the agent’s text generation path from its action path. The agent can compose a message, summarize context, and propose next steps, but the system must hold the content in a pending state until a human approves it. That approval should be specific to the action, not a blanket trust decision for the session. If the agent needs to escalate from draft to external action, that transition should require a fresh decision and a narrower permission scope.
Operationally, this usually means three layers:
- Default deny for all external write actions, including send, publish, create, update, and delete.
- Human-in-the-loop approval for each escalation path, such as sending an email, opening a ticket, or changing a record.
- Ephemeral, task-scoped credentials for any approved action, revoked immediately after use.
This model aligns with current thinking in the NIST AI Risk Management Framework and the CSA MAESTRO agentic AI threat modeling framework, both of which emphasize governance, accountability, and risk-based controls rather than unconditional autonomy. For NHI-specific implementation patterns, NHIMG’s Ultimate Guide to NHIs is a useful anchor for understanding workload identity and secret scoping.
Teams should also log every draft, every approval, and every denied escalation so reviewers can trace when a message was generated versus when it was actually released. These controls tend to break down in highly integrated environments where one approval can unlock multiple downstream systems through shared service accounts or broad API tokens.
Common Variations and Edge Cases
Tighter draft controls often increase friction, so organisations need to balance speed against the cost of review. That tradeoff is real in support desks, sales operations, and internal productivity tooling, where users may want the agent to act quickly once confidence is high. Best practice is evolving, but there is no universal standard for when an agent should be allowed to move from draft-only to limited action. The threshold should be based on task type, data sensitivity, and the maturity of monitoring.
One common edge case is “semi-autonomous” workflows where the agent may populate a form or prepare a ticket but not submit it. Another is environments with shared inboxes or collaboration platforms, where a draft can still expose sensitive content to the wrong audience if permissions are poorly segmented. The safest approach is to treat drafting as content generation, not a privilege grant.
For implementation teams, the key is to avoid overtrusting a single control. The CoPhish OAuth Token Theft via Copilot Studio case study shows how agentic workflows can be abused once token scope becomes too broad, while the Anthropic AI-orchestrated cyber espionage report reinforces that autonomous tool use changes the threat model materially. Draft-only is the correct default, but it should be paired with monitoring, scoped credentials, and frequent review of which actions remain human-approved.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Addresses unsafe tool use and unauthorized agent actions. |
| CSA MAESTRO | TM-2 | Covers agent tool governance and runtime decision boundaries. |
| NIST AI RMF | Supports governance, measurement, and accountability for AI risk. | |
| OWASP Non-Human Identity Top 10 | NHI-01 | Relevant to controlling privileged non-human identities and credentials. |
| NIST Zero Trust (SP 800-207) | PR.AC-4 | Zero trust supports per-request authorization for agent actions. |
Document draft-only policy, owners, logging, and approval criteria for agent actions.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
