Permissions, Logs, and Human Oversight on AI Agents

An AI agent becomes an operational risk when its ability to act grows faster than its controls. Permissions, logs, and human supervision are not add-ons: they define the boundary between a useful assistant and a system that can produce actions that are difficult to explain or reverse.

Minimum permission per tool

Don’t hand the agent a broad credential. Create small tools, with allowed operations and fields. Separate reading from writing. An integration that consults a customer does not need to change registration; A tool that creates refunds must impose maximum amount, reason, and policy.

Use per-application service identity and, when necessary, propagate user identity. Revoke and rotate credentials like any critical system. The agent should never receive the secret in context.

Risk-based approval

Not every action needs confirmation. Sort by impact and reversibility. Searching for information and creating a draft can be automatic. Sending an external message, changing a price, deleting data or moving a value require approval or additional controls.

The approval screen needs to show intent, parameters, source, and expected effect. A context-free “approve” button creates oversight in name only. Also define who can approve each category.

Logs that reconstruct the execution

Record identity, request, model, version of instructions, tools called, parameters after validation, system responses, approvals, cost, duration and result. Protect sensitive data and establish retention. The objective is to reconstruct the decision chain, not to keep reasoning private to the model.

NIST recommends clear responsibilities, documentation, and lifecycle monitoring. These elements help you investigate incidents and adjust thresholds with evidence.

Limits and safe shutdown

Define maximum number of steps, time, cost, calls per tool and data scope. Use idempotence to prevent duplication. Create a switch that suspends actions without dropping essential queries and a read-only mode for incidents.

Supervision that generates learning

Track approvals, rejections, corrections, escalations and reversed actions. Review samples and exceptions. If people automatically approve everything, redesign the experience; if they always reject the same suggestion, adjust the agent or remove the role.

Autonomy must be earned through observed performance. Start in shadow mode, advance to recommendation and release execution by category. Compare this evolution with the [agent, automation or copilot] options(/en/blog/agent-automation-or-copilot-which-architecture-to-choose).