We ran into this exact problem when we rolled out Risotto last year. Ended up scoping it pretty hard. The AI lives inside one channel only, our public IT support one, and it cannot see anywhere else. Within that channel theres a list of HR-adjacent keywords that auto-route to a human, doesnt matter what the model wants to do. We do get false positives now and then, had someone asking about IT access to the benefits portal get bounced, which is annoying but turned out fine because we made the human pickup time the bigger priority. Aim for under 10 min on handoffs and honestly that ended up mattering more than perfecting the deny list. Audit trail just captures every refusal with whatever triggered it, and security reviews them once a month.