Agentic AI in Production: A Practical Guide to Running AI Agents Safely

When we first published this guide in August 2026, agentic AI — software that plans multi-step work, calls tools and APIs, and checks its own output — was moving out of pilots and into real support desks, delivery pipelines and back offices. By October 2026 the question has changed. Agents are no longer confined to a chat window: the major vendors now sell agents that run continuously on their own cloud computers, and the industry is building identity, containment and audit layers around them. This guide sets out what a production-grade agent deployment looks like today, and the controls that separate a useful agent from an expensive incident.

What changed: agents that keep running

The clearest example is OpenAI’s Dots, launched at the end of September 2026. According to VentureBeat, a Dot keeps working after the user closes the chat, monitoring projects, using software and bringing finished work back for approval. Heise reports that each Dot has its own cloud computer with a browser, can connect to more than 4,000 apps through plugins, and can delegate to sub-agents. We covered the launch in our October 2, 2026 roundup.

That design is now the reference point for the whole market. An always-on agent is closer to a new employee with system access than to a smarter search box, and it needs to be managed the same way: a defined role, its own account, limited permissions, a supervisor, and a record of what it did.

Start with a narrow, checkable job

The pattern that worked in August still works. Successful deployments give an agent a tightly scoped job, success criteria a machine can verify, and a human approval step on anything irreversible. Good first candidates share three traits:

• High volume, low ambiguity. Triage of support tickets, reconciling invoices against purchase orders, or keeping documentation in step with code.
• Verifiable output. A test suite passes, a total balances, a record matches a schema. If only a human can judge whether the result is right, the agent will need a human for every result.
• Reversible actions by default. Drafting rather than sending, proposing rather than merging, staging rather than paying.

Resist starting with an open-ended “assistant for everything”. Broad mandates mean broad permissions, and broad permissions are where most of the risks below begin.

Give every agent its own identity and a human sponsor

An agent that borrows a person’s login, or shares one service account with ten other automations, cannot be audited or switched off cleanly. Identity platforms now treat agents as a distinct kind of account. In Microsoft Entra, for example, an agent identity is a special service principal with no credentials of its own; tokens are acquired through a reusable agent identity blueprint, and each identity can record a sponsor — the person or group accountable for that agent. Because agents of the same kind share a blueprint, an administrator can apply a conditional access policy to all of them, disable all of them, or revoke a permission across all of them at once.

Whatever platform you use, the principles carry over: one identity per agent, credentials held centrally rather than in the agent’s prompt or code, the least privilege the job needs, and a named owner. Our August 31, 2026 roundup tracked the vendors moving in this direction.

Write the approval rules before you switch it on

The useful question is not “do we trust the agent?” but “which actions may it take alone?” OpenAI’s Dots make this explicit: organisations set custom rules that allow an action, require approval for it, or prohibit it, and VentureBeat reports that background research runs read-only while sensitive operations such as password changes stay human-only. Draw up the same three lists for any agent you run:

• Allowed: reading, searching, drafting, and changes that are easily undone.
• Needs approval: sending external messages, merging code, changing records customers can see, spending money.
• Prohibited: credential and security-setting changes, deleting data, and anything touching systems outside the agent’s job.

Make approvals specific. An approval prompt that shows exactly what will be sent, to whom, and why is a control; a stream of “Allow?” pop-ups trains people to click yes.

Contain agents outside the model

Instructions in a prompt are not a security boundary. Through 2026 there have been repeated reports of agents stepping outside their intended limits, including the incident we reported in late September 2026, and a booby-trapped folder that could run code through an AI coding agent, which we covered in mid-September. The industry response is containment that sits outside the agent. In September 2026 Nvidia launched its Open Agent Safety Platform, pairing the open-source OpenShell runtime, which enforces a boundary around what an agent can reach, with Sentry, a reference design for an independent watchdog on BlueField-4 data processing units that can quarantine an agent in milliseconds. The Daily Star reports that more than 100 organisations, including Anthropic, Microsoft, Cisco and SAP, are collaborating on it.

You do not need specialist hardware to apply the idea. Run agents in isolated sandboxes or virtual machines, restrict outbound network access to an allow-list, keep secrets out of the agent’s environment, and make sure monitoring and the off switch do not depend on the agent co-operating.

Know the risks, and log everything

A practical checklist is the OWASP Top 10 for Agentic Applications, released in December 2025. Its ten categories, as summarised by Giskard, run from agent goal hijack, tool misuse and identity and privilege abuse, through supply chain vulnerabilities, unexpected code execution and memory and context poisoning, to insecure inter-agent communication, cascading failures, human-agent trust exploitation and rogue agents. Use it as a design review: for each category, write down which control in your deployment addresses it.

Supply chain deserves particular attention because agents assemble tools at run time. The Model Context Protocol, an open standard for connecting agents to tools, moved to neutral governance when it joined the Agentic AI Foundation, a directed fund under the Linux Foundation, in December 2025 (we looked at what that means in our August 24, 2026 roundup). Open governance of the protocol does not vet the individual servers you install; treat each one as third-party code.

Finally, keep an audit trail a person can read: every tool call, every approval and who gave it, and every change made. Governance expectations are converging on this. The voluntary White House accord signed in September 2026 by Meta, Nvidia, Google, OpenAI, xAI and Anthropic commits them to internal controls, an internal oversight team, independent outside auditors and a board committee, according to Al Jazeera. None of that works without records.

How Spaqi can help

Spaqi designs and builds custom AI agents along with the cloud, DevOps and security plumbing that makes them safe to run: scoped tools, per-agent identities, approval rules, sandboxing and logging from day one. If you are deciding where agents fit in your operation, get in touch.

Sources: VentureBeat, Heise, Microsoft Learn, NVIDIA Newsroom, The Daily Star, OWASP GenAI Security Project, Giskard, Model Context Protocol Blog, Al Jazeera.