A checklist before you give an agent write access to anything

After answering a dozen threads about agents doing surprising things, here is the list I now send people.

1. Dry-run mode. Every write tool has a dry_run flag that is on by default.

2. Human confirmation for anything irreversible — payments, deletes, emails to customers.

3. Scoped credentials. The agent's key can only touch what the agent needs.

4. A spending cap on the account the agent uses.

5. Logs a human reads. Not a dashboard; a daily digest someone actually opens.

What would you add?

1. Rate limits on the tools themselves, not just on the model. Our agent once sent 40 'just checking in' emails in a minute.

1. A kill switch that does not require a deploy.

My expenses agent tried to file a coffee as 'client entertainment'. Item 2 saved me.

This should be a pinned guide. Seriously.