How to Vet an Agentic Feature Before You Enable It

The agent conversation used to be about whether to adopt a new agent product. Increasingly it is about a toggle that appears in a tool you already trust: your email client, your document editor, your browser, all quietly gaining a feature that will act on your behalf if you let it. The switch is easy to flip and easy to flip without thinking, which is the problem.

Here is a short vetting checklist to run before enabling an agentic feature, whether the decision is yours alone or one you are making for a team.

First, Separate Draft From Act

The single most important question is whether the feature drafts or acts. A feature that writes something for you to review and send is low risk. A feature that sends, buys, deletes, or files on its own is a different category, because a mistake or a manipulation becomes a real-world action with no human in between.

If the feature only drafts, most of the rest of this list is a light touch. If it acts, run the whole thing. We drew this line in detail in when to let an agent act and when to only draft.

The Access Questions

An agent’s risk is defined by what it can reach. Before enabling, answer:

What can it read? An agent that can see your inbox, files, or calendar can be steered by content in them, including content written by other people. Assume anything it reads could contain instructions.

What can it do, and to what? List the specific actions it is granted, not the vague description. “Manage your email” is not an answer. “Send, archive, and delete messages” is.

Can I scope it down? The best agentic features let you grant a subset: read but not send, one account but not all of them, a spending cap. If the only options are on and off with full access, that is a mark against enabling it for anything sensitive.

Can it be tricked into acting? Any agent that reads untrusted content is exposed to indirect prompt injection, where hidden instructions in a page or message hijack it. We covered a live example in zero-click agent hijacking: what it means for work.

The Data Questions

Enabling an agentic feature usually means more of your content flows to the provider, so the vendor questions still apply. Where is the content processed, how long is it retained, is it used for training, and can you get a contractual answer rather than a marketing one. These are the same questions you would ask of any AI vendor, and they are worth asking again when a familiar tool grows an agent. We laid them out in questions to ask an AI vendor about data and the fuller process in how to audit an AI vendor in 2026.

For structuring the overall assessment, the NIST AI Risk Management Framework is a useful, vendor-neutral reference for the categories of risk to consider.

The Reversibility Question

Finally: if this goes wrong, how bad is it, and can you undo it? An agent that drafts is fully reversible, you just do not send. An agent that sends an email or places an order is not, and an agent that deletes may not be either. Weigh the convenience against the worst irreversible outcome, not the average case.

How to Record the Decision

Whether you approve or decline, write down why, so the next person does not re-litigate it or quietly re-enable it.

Before:

Turned off the AI auto-reply thing, seemed risky.

After:

Declined the email assistant’s auto-send feature for client accounts. It cannot be scoped to draft-only, and auto-send on an inbox with confidential threads is not reversible and is exposed to injected instructions in inbound mail. Read-and-draft mode is approved. Revisit if the vendor adds a draft-only setting.

The second version is a decision someone can act on and revisit, not a vague note.

A Wrivio Context for an enablement decision could say:

Rewrite this as a clear decision record. Keep every feature name and permission exactly as written. State what was approved, what was declined, and the specific reason. Do not soften a decline into a maybe.

Press Ctrl+Shift+Space, paste your draft, and check the diff. A rewrite that keeps the reason and the exact scope is doing its job; one that drops “cannot be scoped to draft-only” has removed the thing that justified the decision.

Common Questions

What should I check before turning on an AI agent feature?

Whether it drafts or acts, exactly what it can read and do, whether you can scope its access down, how the provider handles your data, and whether its actions are reversible if something goes wrong.

Why does draft-versus-act matter so much?

A drafting feature is fully reversible because you review before sending. An acting feature turns a mistake or a manipulation into a real action with no human in between, which is a categorically higher risk.

What is the risk of an agent reading untrusted content?

Content it reads, such as an email or a web page, can contain hidden instructions that hijack the agent. This is indirect prompt injection, and any agent that processes content from others is exposed to it.

Do vendor data questions still apply to a feature in a tool I already use?

Yes. An agent feature usually sends more of your content to the provider, so where it is processed, how long it is retained, and whether it trains on your data all still matter.

How do I make an agent feature safer to enable?

Prefer draft-only or confirm-before-acting modes, grant the minimum access the task needs, keep it away from credentials and unrelated systems, and avoid autonomous access to anything irreversible.

Download Wrivio for Windows to keep your drafting on a local tool with the simplest possible answer to every access question: it only rewrites the text you give it.