A practical field guide from Automation Ace.
Short answer: control AI agent access in Make with layers: limit who can build and edit agents through roles, give agent tools least-privilege connections, offer only the tools the job needs, put validation and caps inside scenario tools, require human approval for risky actions, restrict which scenarios are exposed over MCP, and review agent activity regularly. Instructions in the prompt help, but they are not a security boundary.
Short answer
- Roles decide who can create and change agents.
- Connections and tools decide what agents can touch.
- Scenario logic and approvals decide what actually happens.
- Logs and reviews show what happened.
The principle: agents act as someone
An agent's actions run through connections and permissions that belong to a person or service account. At Waves '26, Make described a “glass box” approach where agents are proxies for a person, checked against the owner's role and connections at the moment they act, and where an agent that exceeds its limits is blocked, asks a person, and the attempt is logged. Some of this belongs to MakeOS, which was in closed beta; see what MakeOS is. Whatever the platform enforces, design as if the agent can do anything its connections allow.
Layers of control
| Layer | Control | Practice |
|---|---|---|
| Organization and team roles | Who can create, edit, run, or only view scenarios and agents | Give most people the least role they need; restrict who can edit production |
| Connections | Which accounts and scopes the agent's tools act with | Dedicated service connections with minimal scopes; avoid personal admin accounts |
| Tools | Which modules, scenarios, and MCP tools the agent can call | Few tools, read-only first, write tools narrow |
| Scenario tool logic | What each tool scenario actually allows | Validate inputs; cap amounts; block risky operations |
| Instructions | What the agent is told never to do | Helpful but not a security boundary |
| Human approval | Who must approve before an action runs | Required for irreversible, external, or high-value actions |
| MCP access | Which scenarios outside AI clients can call | Expose only what is needed; protect tokens |
| Monitoring | Who reviews what agents did | Logs, alerts, and weekly reviews |
Check Make's current organization and team role options and plan features in the Help Center.
An action permission matrix
| Action type | Example | Recommended control |
|---|---|---|
| Read | Look up an order, search a contact | Allow, with data minimization |
| Internal write | Create a task, add a note, tag a record | Allow with validation and logging |
| External communication | Email or message a customer | Draft first; approval until trusted |
| Financial | Issue a refund, create an invoice | Approval required; amount caps in the tool |
| Destructive | Delete records, cancel subscriptions | Do not give agents this tool, or require approval |
| Access changes | Change permissions, share files | Keep with people |
Use scenario tools as boundaries
Instead of giving an agent a raw “update any record” module, give it a scenario tool that does one thing with rules built in: “add a note to a contact,” validated, logged, and unable to touch other fields. For refunds, a tool that only allows amounts under a cap and creates an approval request above it. The agent can only do what the tool allows. See combining agents with rule-based automation.
Human approval for risky actions
Make highlighted human-in-the-loop approvals at Waves '26, where a scenario can pause for sign-off in tools such as Slack, Teams, or the mobile app; check availability on your plan. Even without a dedicated feature, a scenario can create an approval request and continue only after a person responds. See approval workflow automation.
MCP access
- Expose only the scenarios outside clients need, and prefer read-only tools.
- Protect and rotate MCP tokens.
- Log MCP-triggered runs and review them.
See how to connect AI agents to Make using MCP.
Data access and privacy
- Send agents only the fields they need, not whole records.
- Keep sensitive data (health, payment, personal identifiers) out of prompts and knowledge unless approved.
- Choose AI providers and settings that match your data policies.
- Treat content agents read as data, not instructions, to reduce prompt injection risk.
Reviews and offboarding
- Review agent tools, connections, and run logs monthly; see monitoring agents.
- Transfer or replace connections when the owning person leaves; see what happens when someone leaves.
- Remove contractor access at the end of engagements; see access management for contractors.
- Audit unused scenarios and agents; see auditing Make scenarios.
Frequently asked questions
How do I control what a Make AI agent can do?
Limit who can build and edit agents with roles, use least-privilege connections, give agents only the tools they need, build validation and caps into scenario tools, require human approval for risky actions, restrict MCP exposure, and review agent activity regularly.
Are prompt instructions enough to keep an AI agent safe?
No. Instructions help, but they are not a security boundary. Real limits come from connections, the tools you provide, the logic inside scenario tools, and approval steps.
Which agent actions should require human approval?
External communication until the agent is trusted, financial actions such as refunds or invoices, destructive actions such as deletions or cancellations, and anything involving access changes.
How do scenario tools limit an AI agent?
A scenario tool does one job with validation, caps, and logging built in, so the agent can only perform what that scenario allows instead of having broad access through a raw module.
What did Make announce about agent permissions at Waves ’26?
Make described a glass-box approach in which agents act as proxies for a person, are checked against the owner’s role and connections when they act, and are blocked, escalated to a person, and logged when they exceed limits. Some capabilities are part of MakeOS, which was in closed beta.
Disclaimer: Make features, module names, plans, and credit usage change over time, and several capabilities announced at Waves '26 (such as MakeOS and Process Intelligence) were in beta or listed as coming soon at the time of writing; confirm current details in the Make Help Center. This article may include links to apps, products, or services; some links may be affiliate links, which means Automation Ace may earn a commission at no extra cost to you.