An AI agent collects EDR host details for water-utility analysts but is blocked from isolating hosts by itself. What agent design principle applies?

Bounded AI agents that gather context but cannot take high-impact isolation alone embody least privilege and human-in-the-loop design for municipal cyber operations. In a water-utility scenario, an agent that pulls EDR host details (process lists, network connections, alert metadata) accelerates analyst understanding without granting unilateral authority to isolate hosts that may sit near plant operations. The design works because enrichment is comparatively reversible and low-blast-radius, while host isolation can interrupt availability for critical civic infrastructure; separating those capabilities prevents an agent error, prompt injection, or false positive from cascading into operational disruption.

Audited AI agents that gather context with signed logs for detailed analyst review fail because signed logging is detective, not preventive — logs support detailed analyst review after the fact but do not block unilateral isolation and therefore do not enforce least privilege by themselves. Stateless AI agents that gather context anew per query for analyst review fail to address the actual design question: gathering fresh context each time does not remove isolation authority, so the agent would still be able to take high-impact action without human approval. Federated AI agents that gather context locally to support joint detection models fail because keeping gathering local does not bound capability — even where context is gathered locally to feed joint models, the agent still needs to be blocked from unilaterally isolating hosts, which a local-gathering arrangement does not accomplish.

Exam caveat: “bounded” must be enforced in platform permissions and tooling APIs, not only in prompt text; a model instructed not to isolate can still call an unprotected isolation API if credentials allow it. Operational check: inventory agent tool permissions for water-utility workflows, deny isolation/reboot APIs by default, require dual control for high-impact actions, and test that prompt-injection attempts cannot escalate the agent beyond read/enrich scopes.