Governing AI agents: identity, permissions and audit trails

An AI agent is an AI system that plans and carries out multi-step tasks — reading data, calling tools and taking actions in business systems — with limited human involvement. That ability to act is what makes agents valuable, and what makes them a governance question rather than just a technology choice.

An assistant that drafts an email creates a suggestion. An agent that sends the email, updates the CRM and issues a credit note creates consequences. The controls need to reflect that difference.

Think of an agent as a new employee

The most useful mental model is simple: treat each agent like a capable new hire with narrowly defined authority. You would not give a new employee administrator access to every system, the power to approve unlimited payments, or the freedom to act without any record. Apply the same logic.

Control 1: A distinct identity

Every agent should have its own identity — not a shared service account and never a person’s credentials. A distinct identity lets you see exactly what the agent did, grant and revoke access independently, and stop it without affecting anything else.

Control 2: Least-privilege permissions

Grant only the access the agent needs for its defined task. An agent that matches invoices needs to read purchase orders and goods receipts and to propose postings; it does not need to change supplier bank details. Review permissions whenever the agent’s scope changes.

Control 3: Action limits

Define what the agent may do on its own, and within what bounds: value thresholds, record types, customer segments, time windows, volume per hour. Limits contain the damage if something goes wrong — whether a model error, bad data or a manipulated input.

Control 4: Human approval at the right points

Human-in-the-loop does not mean a person approving every step; that removes the value. It means approval where the impact is high: payments above a threshold, commitments to customers, changes to master data, or anything legally significant. Design these checkpoints into the workflow so approving is quick and informed — the approver should see what the agent proposes and why.

Control 5: Complete logging

Log the agent’s inputs, the sources it used, the actions it proposed, the actions it took and who approved them. Logs are how you investigate incidents, answer auditors and improve the agent.

For AI systems classed as high-risk under the EU AI Act, record-keeping is a legal requirement; for everything else, it is simply good practice.

Before release: test like you mean it

Build an evaluation set of realistic cases — including awkward ones: incomplete data, ambiguous requests, attempts to trick the agent through its inputs. Agree the accuracy and safety thresholds the agent must meet before it goes live, and re-run the tests whenever the model, prompts, tools or data change.

In production: monitor and keep a kill switch

Monitor error rates, escalation rates, unusual volumes and cost. Set alerts for anything outside expected patterns. And make sure a named person can pause or switch off the agent quickly, without needing a developer.

Who owns the agent?

Every agent needs three owners: a business owner accountable for its results, a technical owner accountable for how it works, and a risk owner who agrees its limits and reviews incidents. Without named owners, agents drift.

A simple agent register

Start your register with the first agent. It becomes the backbone of your AI governance as agents multiply.