AI Security
Before an AI Agent Goes Live, Review What It Can Actually Do
A practical permission review for leaders deploying AI agents, covering action limits, approval quality, ownership and evidence.
Top One Percent AI · Practical guidance with linked sources.
An AI agent can produce an excellent demonstration and still arrive with permissions your business should not grant. Before approving production use, ask the team to show the actions the agent can execute, the identity behind each action and the systems affected. A feature list will not answer those questions.
OWASP describes excessive agency as risk created by unnecessary functionality, permissions or autonomy. CISA and its partners also recommend limiting agent access and aligning oversight with existing cybersecurity practices. Those principles provide a useful starting point for a deployment review. OWASP excessive agency guidance, CISA agentic AI adoption guidance.
The following review is a practical way to turn that starting point into a business decision.
Start with one business task
Write the task in a sentence a business owner can verify. “Prepare a renewal summary from approved customer records” is specific enough to review. “Help the sales team” leaves too much room for interpretation.
Then describe the successful output. Does the agent return a summary, save a draft or update the customer record? These are different commitments. A team that only needs a summary should be able to explain why its integration also exposes record updates.
Build a simple action register with five columns: business task, permitted action, affected records, approving owner and evidence retained. Review the actual integration configuration against that register. A policy document and a configured permission are separate pieces of evidence.
Examine the action chain
Consider a hypothetical renewal assistant. It reads a customer account, compares contract dates and recommends follow-up. A useful review asks what happens next.
Can it add recipients? Can it attach files from another account? Can it change a commercial field? Can it repeat an operation after a timeout? A harmless first step can become consequential when combined with a second or third capability.
Ask the implementation team to demonstrate the entire chain using synthetic records. Include a customer with a similar name and an account the test user cannot access. Record whether the agent stops, asks for clarification or proceeds. The relevant result is the behavior of the deployed configuration, not a general assurance about the model.
Make approvals understandable
For actions that require review, show the reviewer exactly what will happen. An approval screen should make the affected account, destination, content and scope clear enough to judge.
“Continue?” gives a busy employee little useful information. “Send this renewal draft to these two verified contacts, with this attachment” supports an actual decision. If the destination or attachment changes after approval, the earlier decision should not silently cover the changed action.
Choose a named business owner for each approval category. Do not make every employee responsible for interpreting the same ambiguous warning.
Test the stop path
A production review should include an interrupted task. Disable the relevant integration in a test environment and check whether pending work stops. Determine what remains queued and how an operator can distinguish an unfinished action from a completed one.
Also test recovery after a partial failure. For example, a record update may succeed while the confirmation message fails. Repeating the whole workflow could create a duplicate. Ask for a visible operation identifier and a way to reconcile the result before retrying.
These are recommended acceptance tests, not evidence that any particular product already provides those controls.
Leave with a bounded decision
Approve a defined task, permission set and operating owner. Record what would trigger another review, such as a new connector, broader data access or automatic external communication.
The useful executive question is straightforward: can this team explain and demonstrate the consequences of the authority it is granting? If that answer is incomplete, narrow the pilot until the evidence catches up.