A customer-operations system has an intake classifier, a research worker, a resolution drafter and an executor that issues account credits. In an incident, the research worker followed instructions embedded in a customer email and issued a credit. Select two changes that most directly reduce this risk.

Answer: A and D — Remove the credits tool from every agent except the executor / Gate the executor's credits behind code-enforced limits and human approval above them

Least privilege per agent (a) means the research worker, which reads untrusted content, cannot issue credits at all, and (d) puts a deterministic control on the one agent that can. (b) is prompt-only defense against injection. (c) is a detective control that records misuse instead of preventing it.