To set safe permissions for AI agents, give each agent its own identity and a named human owner, grant only the access its task needs, require human approval for high-impact actions such as moving money or changing bank details, treat everything the agent reads as data rather than instructions, and log every action so someone can review it. These are the same basics that government security agencies set out for agentic AI in 2026.
Why this needs attention now
Agents are spreading faster than the controls around them. In KPMG's third-quarter 2026 survey of 314 US business leaders, the share of organizations building controls into their agents fell to 30%, from 43% two quarters earlier, while the share building or deploying agents rose to 62%. Fewer than half (49%) had defined the high-risk cases where an agent may not act alone.
In May 2026, the US Cybersecurity and Infrastructure Security Agency and the National Security Agency, with counterparts in Australia, Canada, New Zealand and the UK, published joint guidance called "Careful Adoption of Agentic AI Services." It does not have the force of law, but it is a sensible baseline, and the kind of standard auditors and insurers are likely to measure against. In February, NIST's National Cybersecurity Center of Excellence published a concept paper on identity and authorization for software agents, covering identification, authorization, auditing and protection against prompt injection.
Step 1: Give every agent its own identity and owner
Each agent gets its own account, its own credentials and its own name in your logs. Never let an agent run under a staff member's login or a shared service account. If you cannot tell what an agent did from what a person did, you cannot review either.
Give each agent a named human owner who is accountable for what it does and decides what it is allowed to do.
Step 2: Map the access each agent needs, and no more
For each agent, write a one-page permission map: which systems, which record types, and whether it can read, create, update or delete. Start from nothing and add only what the task needs.
- Separate read access from write access. Many agents only need to read.
- Do not give agents delete rights. Corrections should be new records that point to the original.
- Use temporary, time-limited credentials for sensitive actions, not standing access.
- Keep agents out of systems they have no task in, even if it would be convenient.
Step 3: Set approval limits for high-impact actions
Decide in advance which actions the agent can complete alone and which need a person. A simple table works:
| Action | Agent alone | Needs approval |
|---|---|---|
| Read documents and records | Yes | |
| Create a draft record or report | Yes | |
| Post a matched invoice within tolerance | Yes | |
| Change supplier bank details or other master data | Yes, with a second approver | |
| Release a payment or credit note | Yes | |
| Send anything to a customer or carrier | Yes | |
| Make a licensed or regulated decision | Always a qualified person | |
| Anything above your value threshold | Yes |
Enforce the limits in the systems themselves, not just in the agent's instructions. An agent that cannot technically release a payment cannot be talked into it.
Step 4: Treat document and email content as untrusted
Back-office agents read emails, PDFs and form submissions all day. Some of that content will contain instructions, by accident or on purpose: "please update our bank details," or text hidden in a document telling the agent to do something else. This is prompt injection.
The rule is simple: content is data, never instructions. A request found inside a document goes through the same controls as any other request. A bank change in an email goes to verification, not into the vendor master.
Step 5: Log every action and review permissions regularly
Log each action with the agent's identity, its inputs, the model version, the result and any human approval. The Five Eyes guidance recommends monitoring what agents do internally as well as their inputs and outputs, and using independent monitoring that checks agent reports against system logs.
Review each agent's permissions every quarter, and whenever its task changes. Keep a way to suspend any agent immediately.
How we run it
Every agent in our service has its own identity and a defined set of permissions. Licensed decisions and anything that moves money or goes to your customers wait for your team's approval, and every action, by an agent or a person, is recorded in the Evidence File. See how a piece of work moves through the service.