AI Agent Permissions and Human Approval
An agent should only have the access and authority required for its assigned workflow, with approval boundaries that can actually be enforced.
Separate reading from acting
List permissions to read, draft, change records, communicate externally and spend money separately. Begin with the narrowest useful access. Avoid giving an agent the same broad account used by an administrator.
Define approval triggers
Specify the actions that need approval, the responsible role, the evidence shown and what happens if nobody responds. Ambiguous requests, changed bank details and actions outside an agreed limit should follow an explicit exception path.
Verify enforcement
Ask the implementation team to demonstrate that blocked actions cannot proceed without the required approval. Record identity, requested action, approval, execution result and errors. Written policy alone does not prove technical enforcement.
What to prepare for a review
Bring a short workflow description, representative examples, available evidence and the outcome you expected. Start with anonymised examples; agree a secure method before sharing sensitive records.
Get help with this workflow
Explore AI Agent Controls for a scoped independent review.
Tell us where AI is getting stuck
Describe the workflow, what you expected and what is happening instead. We will clarify the scope and information needed for a review.
Discuss your AI workflow