how to stop your ai agents from breaking production - By Sourav Mishra (@souravvmishra)

my top tips for shipping ai agents that don't go crazy and burn all your money.

BySourav Mishra•March 17, 2026•2 min read

every time an ai agent fails in production, it's the same story: no limits, too many permissions, or no human checking its work.

if you fix these four things, your agents won't blow up your app. here is how i do it.

1. put a limit on loops

if an agent can call tools forever, it will. i've seen agents get stuck and call an api 10,000 times. goodbye budget!

always set a hard stop. if you use the vercel ai sdk, just add stopWhen: stepCountIs(10). if it hits 10 steps, it stops. period.

never launch an agent without a step limit.

agents shouldn't share a single admin key. if an agent only needs to read a database, give it a read-only token.

if it gets confused or hacked, it can only mess up the little box you put it in.

if this agent goes rogue, what's the worst it can do?

ask yourself that every time. limit the blast radius.

ai is smart, but it's not "delete production database" smart.

if an action can't be undone (like paying money, deleting users, or publishing posts), make the agent ask a human first.

"agent suggests, human clicks approve." that's the rule.

you can let it search or read stuff on its own, but the big red buttons need a human.

if you have multiple agents talking to each other, you have to be careful. if agent A goes crazy, it can trick agent B into doing something bad.

never just pass raw text between them. use JSON and validate it. if agent A asks for something weird, block it before agent B even sees it.

honestly, just stick to one agent if you can. it's way easier.

get these four things right before you start making it fancy.

written by sourav mishra, keeping bots in check.