Human oversight supplies missing intent, authorization or judgment and gives users a way to redirect or stop work. Useful oversight must preserve enough task state to continue correctly. LangGraph demonstrates persisted interrupts and explicit resume values, including replay constraints. langgraph-interrupts
Isolation limits what execution can reach. Authorization decides which principal may perform which operation on which resource. They complement one another: code can stay inside a sandbox and still misuse an overprivileged API credential.
Agent security controls what information can influence decisions and what those decisions can affect. The model may encounter adversarial content through otherwise legitimate work. Indirect prompt-injection research demonstrates attacks placed in retrieved data; AgentDojo evaluates tool-using agents under such attacks. indirect-injection agentdojo