AI agents can do far more than generate text or summarize information—they can interact with software, retrieve sensitive data and take actions across business systems. That ability can unlock major gains in speed and productivity, but it also raises the stakes when an agent behaves unpredictably, receives excessive access or makes a mistake at machine speed.
Before connecting AI agents to production environments, companies need safeguards that address who controls them, what they’re allowed to do and how their activity will be tested, monitored and reviewed. Below, members of Forbes Technology Council discuss the controls organizations should establish before allowing AI agents to access sensitive data, critical workflows or live systems.
Require Human Approval Before Execution
Keep a human approval step between an agent’s recommendations and execution. While AI can analyze, diagnose and propose actions, a qualified engineer should validate changes before they reach production. In large-scale database environments, this simple control often prevents well-intended but risky actions that could lead to outages. – Devendra Rajput, Accenture
Grant Task-Scoped, Just-In-Time Access
We’re inheriting a problem: role-based access control designed for humans. That gap deserves real attention. Human roles are already overprovisioned, accumulated over years and rarely shed. Hand an agent a role and it inherits that cruft instantly. Agents shouldn’t get roles. They should get just-enough, just-in-time access that’s granted for the workflow, then revoked. Think task-scoped, not role-scoped. – Harman Kaur, Tanium
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
Assign Clear Ownership And Accountability
AI agents are proliferating because they promise to transform how work gets done. Before granting them access to production systems, organizations should establish clear accountability. Every agent needs defined ownership, operating boundaries and auditable actions. The leading enterprises across industries will be those that can accelerate AI adoption while maintaining trust in the decisions and actions AI takes. – Abhijit Kakhandiki, BMC Software
Limit Permissions And Isolate Early Testing
Enforce least-privilege access. Give an AI agent only the narrowly scoped, time-limited permissions it needs for a specific task, preferably in a sandbox or nonproduction environment first, and require human approval for irreversible or high-impact actions. This limits the damage if the agent behaves unexpectedly, is manipulated by malicious input or uses credentials improperly. – Jessica Vitiritti, Bank of Montreal
Define The Use Case And Success Measures
Before granting an AI agent access, map the exact problem it’s meant to solve and how you’ll measure success. Too many companies grant broad permissions without a clear signal for what “working” looks like. Start with scoped, auditable access, then expand only as usage data proves the agent is actually performing as intended. – Brian Stimpfl, S-Docs
Specify A Human Owner For Every Output
There must be named human accountability. Before any AI agent touches production systems or business-critical workflows, assign a specific person who owns every output it produces—not a policy, not a committee, but a person. Governance is not a constraint on what you build. It is what makes what you build worth trusting. – Ali Alkhafaji, APPLY
Build A Trusted, Governed Information Layer
Before giving AI agents access to critical systems, companies need a trusted information layer that ensures every decision is grounded in accurate, contextualized information. Agents are only as reliable as the data they use, so organizations must also establish governance controls that define what agents can access, what actions they can take and how those actions are monitored. – Tony Grout, M-Files
Map And Manage Each Agent’s Identity
Before giving an agent access to production or sensitive data, map its identity: what permissions it holds, what apps and data it can reach, and what it can do with them. Access should be scoped to least privilege, monitored like any other identity and revoked the moment it’s no longer needed. – Ofer Klein, Reco
Set Hard Boundaries Before Runtime
Lock what an agent can do at build time and enforce that boundary at runtime. A human decides which tools an agent can execute when it’s designed, and the model reasons the order of tools to achieve its goals. Real safety isn’t approving actions after the fact. It’s scoping what an agent can do before it ever runs. – Chris Wade, Itential
Treat Agents As Privileged Identities
AI agents must be treated as privileged identities before they touch production. Most organizations have no framework for what an agent can access, who owns it or how its actions are audited. That gap is the attack surface, and it’s exponentially expanding. Enforce least-privilege, just-in-time access with full session accountability, and you close the door attackers are already walking through. – Darren Guccione, Keeper Security
Monitor Agent Behavior In Real Time
Make real-time analytics part of your organization’s AI harness so that you can detect when agents deviate from intended behavior, access data outside normal patterns, interact with unexpected systems, or cross red lines in terms of unacceptable output. This capability needs to be real-time and alert-driven, since by the time you audit static activity logs, the damage is already done. – Jim Richberg, Fortinet, Inc.
Keep Public Models Away From Sensitive Data
Our position: We don’t let public LLMs directly touch protected health information or sensitive data. Only internally developed, tightly governed agents should interface with that information. Public models are built for general use, not for the accountability healthcare data demands. – Virgil Bretz, MacroHealth
Make Agent Access An Architecture Decision
Before granting AI agents production access, organizations should require approval gates, least-privilege permissions and auditable actions. Access should be task-specific, time-bound and regularly reviewed, with human approval for high-impact decisions. The safeguard isn’t a tool you buy; it’s the discipline of treating agent access as an architecture and risk decision, not a config toggle. – Jesse Stockall, Flexera
Issue Policy-Bound Cryptographic Identities
To achieve AI trust, companies need to treat AI agents as machine identities. Issuing cryptographic identities with policy-bound authorization, continuous auditability, governance and lifecycle management is the way to verifiably secure agents in production systems. Granting access without strong identity controls is a blueprint for disaster. – Jason Sabin, DigiCert Inc.
Require Evaluations And End-To-End Observability
No system should go into production without proper evaluations and observability mechanisms. Evals verify that agents consistently behave as intended across various scenarios. Observability provides traces of prompts, tool calls, decisions and actions, allowing teams to investigate mistakes, identify root causes and continuously improve reliability and safety. – Pawel Rzeszucinski, WebPros
Discover And Classify Accessible Data
Before giving AI agents access to production systems or sensitive data, companies need to know exactly what data those agents can reach. Start by discovering and classifying sensitive data, then map access paths and enforce least privilege so agents only reach what they need. This reduces the chance that an agent exposes, misuses or acts on sensitive data it should never have accessed. – Asaf Kochan, Sentra
Bind Every Agent To A Verified Human Owner
Before granting AI agents access to production systems, companies must route all activity through an inline control plane that cryptographically binds each agent to a verified human owner. Establishing this upfront control eliminates shadow AI before it gets out of reach, ensuring explicit, timebound authority and real-time oversight to instantly revoke access if an agent strays. – Bojan Šimić, HYPR Corp.
Enforce Trust Boundaries Between Agents
Designing for asymmetric access is critical. In complex agentic systems, low-privilege agents often interact with highly privileged agents, as well as humans with varying levels of entitlement. Unless every agent boundary is treated as a trust boundary and deterministic authorization policies are enforced, such interactions can create opportunities for privilege escalation, where a harmless low-privilege request gains access to high-privilege resources. – Elliott Cordo, Data Futures
Eliminate Standing Permissions For AI Agents
Threats come from shadow AI, rogue AI agents and bad actors working at machine speed. Every AI agent needs to be provisioned with least-privilege, just-in-time access and no standing permissions. Overpermissive and/or inherited access creates a far larger blast radius than a single misused login. Provision AI agents with narrow, short-lived, fully logged access, and require human approval for anything irreversible. – Tim Currie, In Balance IT Solutions
Route Agents Through Existing Guardrails
Don’t reinvent controls for the AI agent. Identify procedures that already work and give the agent a way to accomplish outcomes through those guardrails. For example, there’s already a network-access-request framework that’s proven, vetted and monitored. Rather than letting an agent touch the network directly, give it a path to leverage the existing framework within already governed controls. – Erez Tadmor, Tufin
