In a recent interview with Help Net Security, Coralogix CEO Ariel Assaraf explained why AI agent safety depends on infrastructure controls, not instructions. He cited the Gemini hacking incident, where a configuration error gave an agent internet access and it entered three real systems despite being meant for a controlled test. The agent eventually stopped, but the boundary was already crossed. Assaraf stressed that a system prompt can describe a boundary but cannot enforce one; if an agent has the technical ability to cross it, enterprises should assume it might.
Assaraf's approach places guardrails at the execution layer, using a policy enforcement point between the agent and its tools. Every proposed action is checked against identity, target, environment, and authorization, and the agent never receives unrestricted credentials. He distinguishes between giving an agent more context and expanding its authority: context should be minimal, retrieved just in time, and access to information should never automatically grant permission to act on it.
He also warned against overly aggressive guardrails, like requiring human approval for every action, which makes agents useless during incidents. Instead, he recommends classifying actions by risk and state transition—read-only queries run automatically, reversible changes get tighter checks, and irreversible actions require human approval. For monitoring, Assaraf emphasizes tracking the consequences of agent actions, correlating telemetry with organizational observability data, since an agent can return 200s and still make terrible decisions.