THE QUESTION, ANSWERED
HOW DO YOU STOP AN AI AGENT FROM TAKING A HARMFUL ACTION?
Check every action before it runs, and do not let the agent be the one that checks it. Put the check between the agent's decision and the system it is about to touch, give it a rule written in plain English by whoever owns the risk, and have it return one of three outcomes: ALLOW, HOLD or BLOCK. The action does not run until it has been checked.
What the guidance already says
The OWASP AI Agent Security Cheat Sheet says it plainly: separate decision from execution, give the agent least privilege, require approval for high-impact actions, and enforce authorization outside the model rather than asking the model whether it should proceed. The OWASP GenAI Security Project lists tool abuse, excessive autonomy and goal hijacking as the risks that make this necessary. The NIST AI Risk Management Framework asks for documented human oversight and for the ability to intervene when the system cannot correct itself.
All of that is right. If you do nothing else, do that.
Where the guidance stops
The guidance tells you where the check goes. It does not tell you what the check returns, who writes the rule, or what happens on the second try. Those three gaps are where agents get through.
- Two outcomes are not enough. Allow or deny leaves no room for the action that is probably fine but should not run unseen. That action needs a third state: held, shown to a person, and released or refused on their say. Why hold, not modify.
- The rule has to come from the risk owner. A policy an engineer encodes is a guess at what the business meant. A rule the compliance lead or the treasurer writes in their own words is the intent itself, and it is the thing an auditor can read.
- Stopping once is not stopping. An agent that is blocked tries another route. It chains a second tool, writes the command a different way, reaches for the network. The check has to sit on every action, not on the first one.
The five things that work
- Put the check between the decision and the action. Not in the prompt, not in the model, not in a log read afterward. Where that point sits.
- Write the rules in plain English, by whoever owns the risk. "Deleting original evidence is prohibited." "Directory writes wait for a person." No code to change a rule.
- Return ALLOW, HOLD or BLOCK, and mean it. A held action does not run until a named person releases it. A blocked action never runs, and neither does the workaround.
- Log every decision: who, what, when, why. Written before the action runs, appended only, complete. What an auditor needs from that record.
- Publish the run, misses included. If a control has never been shown stopping a real agent on tape, with the actions it did not stop listed beside the ones it did, treat the claim as unproven. Ours are here.
What it looks like when it works
A vendor-review agent at Optimo AI was told, during a cleanup task, to remove old evidence from a completed review. The rule said original evidence is never deleted. The deletion did not run. The agent tried again through a different tool; that did not run either. The reviewer saw both attempts in the record. The Optimo AI proof of concept.
In July 2026 a vendor updated the model behind a demo agent overnight. The agent began doing things it had never done, more than 140 attempts in one run to go beyond its rules. Every one was stopped before it executed, with no new rule, signature or patch, because the rules were about the actions, not about the model. The July run.
Common questions
How do you stop an AI agent from taking a harmful action?
Check every action before it runs and return ALLOW, HOLD, or BLOCK. The same holds for a workflow: each step it tries to take is checked before it runs, so a workflow manipulated mid-run still cannot act outside policy. Filtering the prompt does not help once the model has already decided. Mountain Theory evaluates each action against policy and returns one of three outcomes: ALLOW, HOLD or BLOCK. The action does not execute until it has been checked.
Can you stop an AI agent from deleting evidence?
Yes. Mountain Theory stops evidence deletion, and stops the workaround: blocked once, blocked again on the tool-chaining retry, in a published run. In the vendor-review agent's policy, deleting or overwriting original evidence is prohibited outright rather than approval-gated, on the grounds that evidence integrity is not something anyone should be able to sign away in the moment. When the agent was told to clean up old evidence after a review, the deletion never executed, and the refused attempt was written to the audit log. Ungoverned, in the same run, the deletion completed.
How do you decide which AI actions need a human?
A person steps in only where your rules say, and the rule is about what the action changes, not how risky the request sounds. In the published run the dividing line is authority: an agent may draft, summarize, analyze and recommend on its own, because none of those is an authoritative change. The moment an action writes to a system of record, commits the business, or reaches outside the building, it needs a person. That is why "draft a risk rating" is autonomous and "finalize a risk rating" is not, and why "recommend approve or deny" is autonomous and "update the procurement status of record" is not. The same reasoning puts external email behind approval. You set that line yourself, and everything on the safe side of it runs at full speed.
The product, if you want it
Mountain Theory is the check described above, shipped. It works with any AI you already use, in your environment or the cloud.