AI Agent in IT Support: Guardrails That Actually Hold

“You are not allowed to do that” in the prompt is a request. A block is a block.

Anyone who gives an AI agent access to company computers first asks: what if it does something it shouldn't? The honest answer: a language model can be talked into things. See Can you trick an AI agent?. That is why the important limits can't just live in the prompt; they have to sit in the technology around it. In our agent's chats you can see what this looks like, in the messages it gets back when it hits a limit.

Guardrail 1: The protected list

Programs the agent never touches. A real message, when an employee asked the agent to close the remote support program:

“[PROTECTED] The program is on this customer's protected list and must NOT be closed, terminated, disabled or uninstalled, on any device.”

IT sets the list once, and it applies to all devices. Typical entries: remote support, antivirus, backup agent, management tools. The agent doesn't decide this itself, and it can't get around it by phrasing the command differently.

Guardrail 2: The permission profile

Areas the agent doesn't even look into. A real message while searching through logs:

“BLOCKED: Action affects protected software and is blocked by the permission profile.”

The profile defines which programs, paths and command patterns are off limits, even for reading. That protects things like browser data or configurations that are none of the agent's business.

Guardrail 3: Blocked without a back door

Some actions have no approval path at all. A real message, when the agent wanted to install updates:

“This action was blocked by the security check and NOT carried out. There is no approval for it.”

The agent then has to suggest another way or hand over to a human. That is inconvenient, and exactly right for anything that is too broad or too risky for a chat.

Guardrail 4: Approval with an expiry

Sensitive but sensible steps go through a human. A real message, when the agent wanted to switch off antivirus as a test because no app could be installed:

“Required: approval by an administrator AND confirmation on the device. The action only runs after that and expires after 30 minutes.”

The approval also states the problem, the proposed solution and the way back. An “approval” typed into the chat doesn't count. More in AI in IT support: approval under the four-eyes principle.

Guardrail 5: Ask first for anything destructive

Anything that can delete data needs explicit consent. A real message, when the agent wanted to reset update components:

“DESTRUCTIVE: This command can delete data. Ask the user for confirmation first.”

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial

The agent then explained what would be deleted and what wouldn't, and only continued after the “yes”.

Guardrail 6: What the product never does

Not a setting, but a decision. SuperSupport does not do password resets, user accounts or permissions, or firewall or server changes. This cannot be unlocked. See Level 1 AI: what it can do, and what it can't.

What does this mean for rollout?

• Which programs are off limits? – Protected list, maintained by IT
• Which areas may the agent not read? – Permission profile
• What is blocked outright? – Security check with no approval path
• Who allows sensitive steps? – Admin approval, plus confirmation on the device if needed
• How long does an approval last? – fixed expiry time
• What does the product never do? – Product limit, not configurable

Not in the prompt. The prompt may contain the same rules, but it is not the place where they have to hold.

How employees react to these limits is covered in Acceptance of AI in IT support. How in-house software is covered with fixed steps is covered in Runbooks in IT support. Legal aspects in GDPR and AI in support.

Try it yourself

Ask every AI vendor in IT support: where do the limits sit, in the prompt or in front of it? SuperSupport can be tested for free and without a credit card, for internal IT teams and MSPs.

Frequently asked questions

Why aren't instructions in the prompt enough as security?

Because a language model follows instructions, but can also be talked into things. Limits that really have to hold belong in the technology around the model: lists of protected programs, blocked command patterns, approvals that only a human can give.

What is a protected list?

A list of programs that the agent does not close, disable or uninstall on any device, such as remote support or security software. IT sets it once, and it applies to all of a customer's devices.

What happens if the agent attempts a blocked action?

It is not carried out. Depending on the type of action, there is either no way at all, for example with commands that are blocked outright, or a way through approval by an administrator.

Can an employee give an approval themselves?

No. Typing an approval into the chat changes nothing. Sensitive steps need an administrator's approval, some additionally a confirmation on the device, and approvals expire after a fixed time.

What must an AI agent in IT support never do?

With SuperSupport: no password resets, no user accounts or permissions, no firewall or server changes. That is a product decision, not a setting you can configure away.

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial