When Your AI Agent Writes to Systems You Don't Own

A customer credited twice. A legacy connector timed out, the agent read that as failure and retried, and the retry carried no dedup key. The reasoning was fine; nobody had told the system that connector cannot confirm delivery.

An alarm description containing a sentence addressed to the reader. It landed next to the operator’s own instructions, in a window held by an agent with a real write credential, and the agent obeyed. Not a jailbreak: legitimate authority, illegitimately triggered.

Fig. 1 : Two write-path failures. Neither was a reasoning failure, and neither was caught by a better model.

Integration choice is a safety decision before it is a convenience decision. The dominant risk stops being “did the model reason well” and becomes “did we corrupt someone’s data”.

Pick from the system’s characteristics, not from what is convenient to build.

The write-safety ladder

Every interaction sits on exactly one rung, and that rung grades two independent things.

Fig. 2 : Blast radius runs left to right, commit authority bottom to top. Rung 4 is a row above, not a step along.

• Blast radius is a property of the action: nothing, a draft, one system, several.
• Authority is a grant from the process owner. Rung 1 does not commit at all: a reviewer does, having read a proposal. Rungs 2 and 3 commit under case-by-case approval, and rung 4 is the only rung that commits without one, because a standing policy pre-authorised the class.
• Name both in the agent contract. A rung on its own is ambiguous, and ambiguity here is how production incidents happen.
• Rung 4 is a statement about authority, so write the blast radius beside it. B3/A-standing carries what rung 4 throws away. A multi-system write promoted to rung 4 still needs every compensating action that made it safe at rung 3, and a bare 4 is exactly how that requirement goes missing.
• Most agents in a mature estate sit permanently on rungs 0 and 1. That is a healthy distribution, not timidity. It is not a complete defence either: a rung 0 agent that holds sensitive data, reads untrusted content and owns any outbound channel is the standard exfiltration path, and the write gate does nothing about it. Outbound channels are easy to miss because they do not look like writes. A drafted comment, a fetched URL and a parameterised query are all egress.

ON THE SCALE: these rungs grade a write mechanism and the authority behind it. They are not the T0 to T4 autonomy tiers used for grading a decision grant.

Both ascend with permissiveness, and their digits do not line up. Rung 2 here means a reviewer clears every write; T2 there means the human has already left the loop. Rung 4 is the first rung that commits without per-case approval, which makes it the mechanism-side counterpart of T2 and above. Never carry a number from one scale into a review governed by the other.

Fig. 3 : Three steps. Establish blast radius from the action, then ask separately what the process owner has actually granted.

• Step 1 disqualifies more than people expect. If a policy could decide it with no context the agent gathers, you need deterministic automation, not an agent.
• The bottom of step 2 is the branch worth dwelling on. The answer to an uncompensatable multi-system change is not a cleverer agent, it is a different transaction boundary. Order it so the step that cannot be compensated comes last in the compensatable prefix, as the pivot, with everything after it retriable under forward recovery. Only when that ordering cannot be achieved is the boundary genuinely wrong.
• Step 3 is a governance question, not a mechanical one. Step 2 tells you the most permissive rung the mechanism could support. Where mechanism and grant disagree, the grant wins and the control plane enforces the lower of the two.

Every tool reading content from outside your trust boundary is an instruction channel. Alarm text, ticket comments, PDFs and MCP responses all land next to your own instructions, and a model cannot tell which you meant it to obey.

Fig. 4 : Operator intent and retrieved content stay in separately labelled channels, on a task-scoped credential.

Fig. 5 : The gate evaluates the proposed action against process state and ignores the justification, which is what an injected instruction controls.

• Separate the channels. Keep retrieved content and operator intent in distinctly labelled channels rather than concatenated prose. Treat it as defence in depth rather than a fix: labelling and delimiter schemes lower the success rate of an injection and are routinely bypassed. Of the three mitigations here, only the credential scope and the gate still hold when labelling fails.
• Scope the credential to the agent and the task, not to the service account, so a compromised reasoning loop borrows narrow authority rather than broad.
• Entity resolution belongs in the knowledge layer, as a tested component with a published confidence score and an explicit “could not resolve” path that never renders the same as “no match found”. An agent reasoning across a bad join produces confident nonsense that reads as insight.

A tier-1 operator wants one defined class of incident detected, diagnosed and remediated with no human in the path, and everything else escalated with a prepared case file.

• The autonomy gap does not force separate systems. Nothing prevents these agents sharing context. What differs is only what each may commit, which the ladder and the gate already resolve.
• Duration decides the shape. Problem management runs for days, remediation waits on change windows, and the case must survive a restart, so case state belongs in a durable store.

Fig. 7 : Six agents in the layer and a seventh in the control plane, five distinct autonomy levels, and not one of them holds a credential for the orchestrator.

Alarm storms generate enormous, largely irrelevant evidence, so each hypothesis runs in a disposable isolated sub-agent: the parent receives a bounded verdict, never a transcript.

Fig. 8 : Eight stations, and every dashed exit is a decision the gate refused to make autonomously. Each one is an audit record.

Fig. 9 : The loop spans three processes with different owners, clocks and grants

• An operator is never simply “at TM Forum Level 3”. It is at Level 3 for a named scenario set in a named domain and Level 1 everywhere else, and the second half is what gets dropped in board packs.
• That scale grades a network domain; the rungs grade one interaction. A claim on one does not convert into a claim on the other.
• Rollback frequency rising alongside autonomous closure is not progress. It is risk accumulation.

Promotion is earned with measured evidence, never granted at design time.

Instrument the outcome: mean time to detect · mean time to resolve · share of incidents closed with no human touch · false-positive remediation rate · rollback frequency.

Instrument the write path too, because all of the above are lagging: gate refusal rate by reason code · dedup key hit rate · unconfirmed-delivery rate per connector · writes left unreconciled past threshold · detected injection attempts. A rising dedup hit rate is the early warning that the first incident is happening again.

The duplicate credit was an access-pattern error made two layers earlier: an RPA connector treated as though it confirmed delivery. Three controls belonged in the tool facade, and the rung 2 contract should have named all three. A dedup ledger the facade owns and that survives its own restart, because a legacy target will not honour an idempotency header. A read-back against the system of record after every write, since delivery that cannot be confirmed in band can almost always be confirmed out of it. And an alert on any write still unreconciled past a threshold: the zero in that incident panel is the tell.

The alarm that gave orders was a gate-placement error. The agent held the authority legitimately; the gate was reading its justification rather than its proposed action, and the justification is exactly the artefact an injected instruction controls.

Seven agents, a great deal of reasoning, and not one of them holds a credential for the orchestrator. The planner proposes, code decides, a deterministic executor acts, and a separate agent checks whether the world actually changed.

All of that is recoverable if the reasoning is wrong. Almost none of it is recoverable if the write path is wrong, which is why the write path is the part to design first.

This piece assumes two things are already settled: which topology you're running — see Single Agent or Multi-Agent? for that decision — and that a control plane exists to hold the gate this piece describes.

What are AI agent permissions, and how should they be structured?

An AI agent's permissions can be graded on two independent axes: blast radius (how much a proposed action touches, from nothing to several systems) and commit authority (who or what approved it). Together these define a rung on a write-safety ladder, written as both values combined, such as B3/A-standing, because the number alone loses one of the two axes.

How do you authorize an AI agent to write to a system?

Ask three questions in order: whether the decision is deterministic enough that a policy could make it without an agent at all, whether the action can be compensated if it turns out to be wrong, and whether the authority actually granted by the process owner matches what the write mechanism supports. Where the mechanism and the grant disagree, the grant wins.

What is the highest level of AI agent action authorization?

The highest rung commits without case-by-case approval, because a standing policy has pre-authorised that class of action. It still inherits every structural requirement from the permission level it was promoted from, including any compensating action required one rung down.

How many permission levels does a production AI agent deployment need?

In a worked network-operations example with seven agents, the deployment used five distinct rungs, or permission levels, at once: full autonomy for detection and correlation, read-only for diagnosis, propose-only for remediation planning, and check-only for change compliance. No single agent held a credential for the orchestrator itself.

Working through this for your own architecture? Blue Data Consulting designs and delivers multi-agent enterprise platforms across telecommunications, semiconductor manufacturing and healthcare. Start a conversation with our architecture team.