The useful question is not whether AI agents are trustworthy in general. It is which specific tasks you should hand over, with what access, and with which checks in place. Those are answerable, and the answers come from thinking about consequences rather than capability.
Start with reversibility, not capability
Sort any task by what happens if it goes wrong.
Reversible and cheap. Drafting, searching, summarizing, organizing a copy. If the output is wrong you delete it. Hand these over freely.
Reversible but annoying. Editing files you have backed up, reorganizing a folder, bulk-renaming. Fine to delegate, worth reviewing afterwards.
Hard to undo. Sending messages, publishing, deleting, changing settings, spending money. These need approval before the action, not review after it.
Never delegate. Anything legally binding, anything affecting someone's employment or finances, anything you could not explain afterwards. Not because an agent would necessarily get it wrong, but because you cannot transfer the responsibility.
Notice that none of this depends on how capable the agent is. A more capable agent still leaves you holding the consequences of an irreversible action.
Least privilege, concretely
Most agent trouble is not an attack. It is ordinary work done in a wider scope than you meant.
Give access to the specific folder, the specific label in the mailbox, the specific repository. Prefer read-only wherever the task allows it. Use a separate account for the agent rather than your own, so its reach is set by configuration rather than by your own permissions, and so the logs show clearly which actions were its.
The test is blunt: if this agent behaved as badly as possible within the access it has, what is the worst outcome? If that answer is unacceptable, the access is too broad — regardless of how carefully you worded the instructions, because instructions are requests and permissions are not.
The risk that has no clean fix
Agents read external content: web pages, emails, documents, search results. Everything read becomes context. And the model has no dependable way to separate instructions you gave from instructions embedded in content it fetched.
So a page can contain a line aimed at the agent. A shared document can carry text you never see. An email in a mailbox the agent was asked to summarize can tell it to forward messages elsewhere. If the agent has the tools to comply, it may.
This is prompt injection. It needs no technical skill, and there is currently no complete defense. What helps: keep the tool list minimal, require approval before anything that sends or deletes, prefer read-only access, and treat any content the agent fetched as untrusted data rather than as direction.
Any agent that both reads untrusted content and can take consequential actions carries this risk permanently. That is a reason to be deliberate about which of those two capabilities you actually need, not a reason to avoid agents entirely.
Why long runs deserve more suspicion
Suppose, purely as an illustration, that each step is right nineteen times out of twenty — an assumption, not a measurement. If twenty steps all need to be right, a clean run happens roughly one time in three. Nothing malfunctioned; per-step accuracy just does not survive multiplication.
Worse, an early wrong observation becomes a premise. The agent then reasons correctly from something false, and by step twelve it is working competently on the wrong problem. The output has no visible seam where the error entered.
Practical consequence: prefer several short runs you check over one long run you cannot. When you review, ask what it observed rather than whether the summary reads well. Where agents fail covers the full set of failure modes.
A checklist before you delegate
Work through this before an agent touches anything real.
Is the goal specific enough to be judged done? Vague goals produce scope creep, every step of which looks defensible.
Can I state exactly what it may touch? Name folders and accounts, not categories.
Which steps are irreversible, and is there a gate before each one? A gate that announces and proceeds is narration, not control.
Is there a hard step limit and a spending cap enforced by the software? An instruction to be economical is advisory; a harness that refuses the next call is not.
Will there be a log I can read? The agent's own summary of its work is another prediction. The log is evidence.
Could I verify the result if I had to? If you could not tell a good outcome from a plausible-looking bad one, do not delegate that task yet.
Building the judgment
Run an agent on tasks whose answers you already know. It is the only reliable way to learn how a particular setup fails, because you catch errors instantly instead of trusting them.
Start with a copy rather than the original. Ask for a plan before any action and actually read it. Keep early runs short. When you review, use something structured — our agent review prompt compares the action log against the summary, which is where the gap usually shows.
The honest answer
Trust an agent the way you would trust a capable new colleague on their first week: with real work, clear boundaries, reversible tasks, and a look at the result. Not with your credentials, not with irreversible actions, and not with anything you could not check.
That is not skepticism about the technology. It is the same standard you would apply to any fast worker whose mistakes look exactly like their successes. Our Agentic AI course covers the guardrails in practical detail, free and without an account.