If you're deploying AI agents this year, here's the minimum you should have in place before anything touches production.
This isn't a comprehensive framework. It's the short list, the stuff that would have prevented most of the incidents making headlines right now.
Scoped tokens only
Every agent gets its own service account with the minimum permissions required for its specific task. Not a shared account. Not a broad token you already had lying around. One agent, one identity, one defined scope.
Production and staging never share a failure boundary
If your agent can reach production from a staging task, that's an architecture problem, not an AI problem. Separate the environments. Separate the credentials. Separate the blast radius.
Backups live outside the primary failure scope
This sounds obvious until you read about a company losing three months of data because their backups were stored on the volume the agent just deleted.
Destructive operations require explicit confirmation
Your agent should never be able to delete, overwrite, or permanently modify anything without a human-approved gate. Ever.
Agents cannot self-escalate credentials
If the agent hits a barrier and goes looking for a token in an unrelated file, that's not resourcefulness. That's a control failure waiting to happen.
Log everything
Every tool call, every data source accessed, every action taken. If you can't reconstruct what your agent did in the last 24 hours, you don't have an audit trail. You have hope.
None of this is advanced engineering. These are decisions you make at the start, when they cost almost nothing. Make the same decisions after something goes wrong and they cost a whole lot more.