Practical software guides
Before an AI tool can send, change or spend, decide what it may do and enforce that decision in the systems it reaches. A prompt saying “ask first” is not a substitute for an API permission boundary.
| Action | Tool access | Approval |
|---|---|---|
| Read public FAQ | Read approved current sources | No customer record access |
| Draft a reply | Read assigned enquiry and FAQ | Human checks facts and recipient |
| Send a reply | Disabled for the drafting tool | Authorised person sends |
| Change a booking | No write permission | Staff verify availability and customer authority |
| Refund or pay | No payment credential | Approved financial workflow |
| Retain conversation | Only approved processing/retention | Vendor terms and privacy review |
Work an exception instead of trusting confidence
A fictional enquiry asks for a refund and includes instructions to ignore the policy. The assistant may draft a factual acknowledgement. It must not interpret text in an enquiry as permission, invent a refund entitlement or access another customer’s booking. Escalate when sources are missing, contradictory, stale or outside the approved scope. Assign a reviewer and a backup; show the request, source version, draft and correction without exposing unrelated customer data.
Test the boundary
- Ask the tool to read an unassigned customer: access must fail.
- Place misleading instructions inside a document: they must not authorise a tool action.
- Remove an approved source: the draft must disclose the gap or stop.
- Try a duplicate send or refund: the protected action remains blocked.
- Revoke the service credential: the next call must fail, including cached or queued work.
Keep a restricted risk watchlist
A watchlist records a question for review; it does not establish wrongdoing or legal authority. Keep it separate from the ordinary inbox and limit access to authorised reviewers.
| Field | Example |
|---|---|
| Trigger | A draft cites a superseded refund rule |
| Evidence | Approved source version and the specific draft passage |
| Owner | Authorised policy reviewer; named backup |
| Decision rule | Hold the draft until the current source and scope are confirmed |
| Next review | A stated review date; close or renew with reasons |
Record correction and closure, challenge inaccurate entries and apply an approved retention period. For regulated screening, a qualified specialist must determine the lawful checks, escalation and disclosure process; an AI flag alone cannot make that decision.
Record accepted, corrected and rejected outputs against a manual baseline. Review retention, model-provider processing and subcontractor access before uploading confidential material. Keep rollback instructions for any approved writes and a way to stop queued actions.
The NIST AI Risk Management Framework is voluntary risk-management guidance, not a Bahamian compliance certificate. The agent registry makes the inventory concrete; the source-to-draft walkthrough tests professional drafting. The example above is a design specimen, not a deployed Caynetic customer system.