Define identity, skills, knowledge, budgets, permissions and escalation before activation.
Choose one measurable responsibility and only the records and tools needed for that role.
Block payments, deletion, security changes and unauthorised exports. Use manager or owner approval for customer-impacting work.
Create the employee as a draft, run simulations, review quality and only then connect approved provider routes.