Operations managers see across processes, so train them on what only they can see: the same planted text in invoices, claims and tickets; backlogs that tempt teams to clear holds unread; and pressure to widen an agent's bounds before it has earned it. The response: read patterns, protect holds from targets, change authority only through certification.
Why do operations managers need their own training?
Frontline reviewers see one queue. Operations managers see several: the invoice agent, the claims agent, the service desk agent, the people reviewing each, and the targets that drive all of them. That vantage point changes what manipulation looks like.
Prompt injection across processes. An attacker who finds that one agent reads documents will try the same trick elsewhere. The same hidden phrase may turn up in a supplier invoice, a customer complaint and a service ticket in the same week. Each team sees one instance and shrugs. The operations manager can see the campaign.
Pressure on the queue. Held items are the visible cost of governance. When backlogs grow, managers are asked why. The easy answer is to tell teams to clear them faster, which is exactly what an attacker relies on.
Pressure on authority. The most consequential pressure is to widen what an agent may do: "Can't it just pay invoices under a thousand?" The OWASP Top 10 for LLM Applications names excessive agency as a core risk. In a governed system, depth is earned, not configured: the role sets a ceiling, certification evidence sets the depth, and the lower wins. Operations managers must know that the right answer to "can we let it do more?" is "only if it certifies at that depth on our cases".
A governed agent treats document text as content and holds what rests on weak sources. Managers protect that design by keeping holds and bounds intact under pressure.
The chief operating officer owns this training. Security and the agent owners contribute.
What are the steps?
- Learning lead: runs a baseline. Managers review a month of anonymised holds and refusals across their agents and say what they notice.
- Trainer: explains depth, bounds and certification, and why typed or planted instructions do not change them.
- Agent, depth 1: produces cross-process pattern reports: flagged text by phrase, holds by source class, refusals by bound, across all agents a manager oversees.
- Security team: seeds a cross-process campaign in a test workspace, with the same planted phrase in an invoice, a claim and a ticket.
- Managers: read the pattern reports, find the campaign and escalate.
- Trainer: runs pressure scenarios: a director demanding the backlog cleared today, a business head asking to raise an agent's depth.
- Agent, depth 1 in live management: reports patterns weekly. Managers review them and brief team leads.
- Managers: route every request to widen bounds to the agent's owner for certification, and log the request.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Baseline | Nothing | none | Managers |
| Pattern reports | Groups flags, holds and refusals across agents | 1 | Managers interpret |
| Seeded campaign | Processes test items in several agents | 1 to 3 | Managers detect and escalate |
| Pressure scenarios | Nothing | none | Trainer |
| Weekly review | Reports patterns | 1 | Managers brief team leads |
| Bounds requests | Nothing | none | Agent owner, certification |
What should operations managers learn to recognise?
- Repeated phrasing across different processes. A campaign, not a coincidence.
- A rise in holds from one source class, such as external documents from a new channel.
- Holds cleared faster than review allows, especially when backlogs are high.
- Requests to "just raise the limit" without new certification evidence.
- Workarounds: refused actions followed by people doing the same thing manually.
- Partners' systems writing to yours. Content from another organisation's agent is still external.
Which controls leave evidence?
Weekly pattern review. Evidence: manager's sign-off on each report.
Holds excluded from throughput targets. Evidence: the target definitions.
Bounds changes only through certification. Evidence: certification run preceding each change, and the request log.
Campaign escalations. Evidence: security reference and team-lead briefing.
Workarounds investigated. Evidence: note on each pattern found.
What should you measure?
- Time to detect a seeded cross-process campaign.
- Bounds-widening requests, and how many were certified before taking effect, which should be all.
- Hold clearance times during backlog peaks.
- Workarounds found and resolved.
Where does training usually go wrong?
Managers think injection is a frontline problem. The cross-process view is theirs alone.
Backlog pressure goes unchallenged. Managers pass it down rather than pushing back up. Training must give them the language and the backing to explain why holds take time.
Depth is treated as a setting. Someone finds where to change it. Make it clear that changes without certification are a control failure.
Pattern reports go unread. Build their review into the weekly operations meeting, with a named owner for each pattern found.
Risk and property managers face related pressures in their own settings; see how to train risk managers to spot prompt injection and pressure and how to train property managers to spot prompt injection and pressure. System-side defences are in how to prevent prompt injection in AI agents and OWASP prompt injection and AI agents that act. The full programme is in training teams for AI agents.
Where the Academy fits
Operations managers are a core audience for Pryme Intelligence Academy's Operator track, whose modules on reading the workspace, when something goes wrong, usage and billing, and running the rhythm match the cross-process view this training needs. Managers responsible for several agents in a regulated setting may go on to the Architect track.
Questions people ask
Can an operations manager raise an agent's depth?
Not directly. The role sets a ceiling and certification sets the depth. The manager can request a change; the agent's owner runs certification.
How do we explain held-item backlogs to leadership?
Show what the holds caught, and the cost of what they would have let through. Then add reviewer capacity rather than lowering the bar.
Should managers read individual items?
Only where the pattern report points. Their value is the view across processes.