Set Better Boundaries for Your AI Agents ()

Executive Introduction & Context

For decades, software has been designed around the individual user, with product designers improving the experience by adding more menus and features. Generative AI has shifted this model of digital interaction. Instead of asking users to adapt to the software, AI software can increasingly adapt to them, tailoring how users search, decide, and work to how they want the interaction to unfold. As that happens, it begins to move beyond the boundaries of individual applications, helping users accomplish what they need across the systems and tools involved.

For mission-driven organisations, however, designing everything around the individual only gets you so far. Nonprofits, philanthropies, foundations, and healthcare charities operate as collective actors: decisions move across teams, systems, and lines of responsibility, rather than resting with any one person. This distributed structure, bound by strict fiduciary, ethical, and donor requirements, is what a purely individual-centric design misses.

Agentic AI offers a different proposition. Unlike AI chatbots that wait for individual prompts, agents can work across applications and carry out parts of a workflow themselves. And as agents develop to become more autonomous, a new question emerges: how much of mission-driven work can be safely handed over, and who answers for it when something goes wrong?

For mission-driven organisations, then, the next step is not another point-solution chatbot or copy generator. It is an agentic AI platform structured as an enterprise AI Control System, one that gives agents room to work without giving them the run of the place.

More Capability Means More to Control

Each generation of AI software has given the technology a little more room to operate. With tools like ChatGPT or Claude, the employee remained firmly in control: AI produced an answer, but a person decided what happened next. Point solutions pushed AI deeper into particular functions, but left knowledge and oversight scattered across applications.

Agents begin to cross that boundary. They can retrieve organisational information, move between systems, and take actions on an organisation's behalf. In a governed agentic platform such as CURA, that autonomy can extend across a workflow rather than ending with a generated response. The very capability that makes agents useful also raises the stakes when something goes wrong.

This changes where control has to sit. When AI only produces an answer, the individual user can provide much of the oversight. When AI can act across an organisation, that oversight has to become organisational too.

What Organisational Control Actually Means

Organisational control does not mean requiring a human to approve every move an agent makes. That would defeat much of the point of using agents in the first place. It means deciding where their autonomy begins and ends.

For organisations deploying agents, control therefore comes down to four questions: What can the agent know? What can it access? What can it do without asking? And can we reconstruct what it did afterwards?

These are questions of context, access, action, and accountability.

Context — What Can It Know?

Agents built on large language models (LLMs) need context to produce useful results, and in an organisation that context may come from far more than a prompt. A grant-reporting agent, for example, might draw on previous submissions, program results, donor requirements, and internal documents. But useful context does not mean unlimited context. An agent should know what it needs to do its job, not everything the institution knows.

Access — What Can It Reach?

Agents become considerably more powerful when LLMs are connected to external tools and applications. An agent might query a CRM, search a document repository, or retrieve financial data as part of a workflow. But access is itself a form of authority. Reading a donor record is different from editing it; retrieving payment information is different from authorising a payment. Permissions need to preserve those distinctions.

Action — What Can It Do Without Asking?

This is where autonomy becomes consequential. When an LLM generates an incorrect answer in a chat window, the mistake can be caught before it goes anywhere. An agent that can use tools may turn the same mistake into an action. Drafting a donor email, sending it, changing a financial record, and approving a payment should not carry the same level of permission.

Accountability — Can We See What It Did?

Organisations need an audit trail showing what an agent accessed, what action it took, and where a human approved or intervened. Without that record, an organisation may successfully delegate the work while losing the ability to explain how the work was done.

Anatomy of an Enterprise AI Control System

An AI Control System turns these boundaries into infrastructure. Version-controlled organisational memory governs the context agents work from, keeping every change to institutional knowledge tracked rather than silent. Role-based access control (RBAC) determines what they can reach, so retrieving a record and editing one are no longer treated as the same permission. Approval gates reserve consequential actions for humans, holding the line between drafting something and executing it. Exception routing and anomaly detection catch cases that fall outside normal boundaries before they compound into larger errors. And immutable audit logs preserve a record of what happened, so delegation never comes at the cost of explanation.

There is useful precedent for this approach in software engineering. Development teams already allow considerable freedom inside controlled systems: version control records changes, automated checks test them, pull requests create approval points, and deployment pipelines determine what reaches production. Agentic AI needs a similar operating logic: autonomy within boundaries, with controls becoming stricter as actions become more consequential.

Frequently Asked Questions