Every AI automation needs a finite safety envelope before it starts

Runaway means loss of bounded control, not merely a long task

A system can run away by repeating model or tool calls, spending beyond intent, writing duplicate records, expanding the task, messaging people, escalating privileges, consuming storage, retrying irreversible actions, or continuing after evidence says stop. A ten-minute workflow can be unsafe if one call transfers money; a two-hour read-only analysis may remain controlled. The automation safety envelope defines maximum consequence and duration before execution. OWASP describes excessive functionality, permissions, and autonomy as causes of excessive agency. NIST frames broader risk management and human oversight. These sources guide controls but cannot determine one universal limit; the operator must choose bounds from the task and failure consequence.

Evidence: National Institute of Standards and Technology; OWASP Gen AI Security Project

The objective must include a terminal test and non-goals

Write the concrete artifact or state, permitted resources, success evidence, maximum attempts, and conditions for complete, no work, blocked, cancelled, or failed. Exclude adjacent improvements and future tasks. A goal such as optimize marketing forever has no natural stop; prepare one draft from this approved source packet and route it for review does. The system should not reinterpret lack of progress as permission to broaden scope. Store state outside free-form model memory so restart does not duplicate work. Completion should be determined by observable evidence and independent checks where appropriate, not by the model announcing that it succeeded.

Evidence: National Institute of Standards and Technology; OpenAI

Budgets belong to several dimensions at once

Set maximum model turns, tool calls by type, wall-clock time, tokens or compute, currency, records read and written, files and bytes changed, network destinations, recipients, retries, and concurrency. Add per-step ceilings so one tool cannot consume the whole run. Choose thresholds that stop before unacceptable harm, with alerts before exhaustion. A spend cap alone does not prevent a low-cost deletion; a turn cap alone does not prevent one expensive purchase. Make the budget visible to the orchestrator and user, update it atomically, and fail closed if accounting is unavailable. Renewal requires explicit authorized action, not an agent-generated justification.

Evidence: National Cybersecurity Center of Excellence; OWASP Gen AI Security Project

Capability is shaped by tools, identity, and data scope

Provide only functions needed for the current job, narrow parameter ranges, scoped credentials, allowed objects, and trusted destinations. Prefer read-only access, drafts, sandboxes, transaction previews, idempotency keys, and reversible operations. NIST NCCoE's agent identity work is emerging rather than a finished universal standard, but its focus on identity, authorization, auditing, and non-repudiation highlights an important boundary: an agent needs a distinguishable principal and attributable actions. Do not share a generic administrator identity across agents. Validate tool arguments and outputs outside the model, and treat retrieved instructions as untrusted data rather than new authority.

Evidence: National Cybersecurity Center of Excellence; OWASP Gen AI Security Project

Stops need independent enforcement and a recovery state

Implement user stop, automatic budget stop, repeated-action detection, no-progress detection, abnormal error or cost spike, policy violation, revoked permission, and external incident stop. The stop path must work when the model, network, or provider is unresponsive. Cancel queued actions, prevent new calls, preserve a consistent checkpoint, and identify uncertain external effects for reconciliation. Never blindly retry an action whose result is unknown; query the system of record or require human review. A visible button that only sends another prompt is not a kill switch. Test stops during tool execution, between steps, after restart, and while approval is pending.

Evidence: National Institute of Standards and Technology; OpenAI

Approval and traces turn autonomy into accountable delegation

Bind approval to exact action, parameters, data, recipient, cost, expiry, and workflow version. Increase approval strength for external communication, financial, destructive, privileged, sensitive-data, or public actions. Log state transitions, model and tool events, authorizations, results, budget changes, stops, and human decisions while redacting secrets and excessive personal data. A trace is evidence for diagnosis, not permission to run. The next action is to draw one automation's safety envelope and find the first dimension with no enforceable limit. Limits remain: rare failure combinations escape tests, platform internals are opaque, logs can fail, and controls require maintenance. Do not enable unattended action until the envelope can stop and reconcile without the model's cooperation.