The pilot worked, so someone connects the agent to your accounting package. The quickest login available is the finance manager's, or a shared admin account. Nobody chooses this on purpose. It saves an afternoon, and it means your agent can now do everything that person can do.
AI agent access control prevents that. It means deciding, before an agent touches finance or customer data, what it may read, what it may change, what needs a person's approval and how you will know what it did.
The need is real: in a 2025 survey of 353 IT professionals run for the identity vendor SailPoint, 82% of organizations already used AI agents, 80% said their agents had taken unintended actions, and only 44% had policies to secure them.
What follows is a plain setup you can ask for in any agent project, with the questions to put to your software partner at the end.
Why an AI agent needs its own login, like a new hire
A new employee gets their own account, a manager who answers for them and access to what the job needs. An agent should be set up the same way: its own account in each system it touches, and one named person responsible for it. Three things follow from that.
Accountability. The log shows that the agent made a change, not that the finance manager did.
A clean off switch. You can disable one agent without locking out a colleague or breaking another agent.
A place to hang limits. Permissions, spending caps and working hours attach to the agent's account, not to a person's.
For your engineers, that means a separate service account or API key per agent, scoped in the system itself, with credentials kept in a secrets manager and never pasted into a prompt.
NIST's cybersecurity center collected over 600 responses on how to identify and authorize AI agents and is now testing whether existing identity standards can cover them. You do not have to wait for that. The habits below work with the accounts and permissions your systems already have.
Give each agent the least access it needs
The OWASP project's list of risks for AI applications names three root causes of an agent doing damage: excessive functionality, excessive permissions and excessive autonomy. Its first remedy is to limit what an agent can reach to the minimum necessary. Decide the limits per job, in writing, before the agent is built.
Agent job | Give it | Keep it away from |
|---|---|---|
Chases overdue invoices | Read open invoices and customer contacts; log a reminder | Bank data, payroll, changing an invoice amount |
Triages support requests | Read the ticket and order status; draft a reply | Refunds, exports of the whole customer list |
Follows up sales leads | Read deal notes; create tasks | Deleting records, other teams' accounts |
Enforce these limits in the systems, not only in the agent's instructions. A prompt that says "never issue refunds" can be talked around, but an account with no refund permission cannot. Our governance checklist for AI agents covers who owns, approves and stops each agent.
Separate agents that read from agents that change records
Treat these as two kinds of agent with two kinds of account. A reader summarizes, answers questions and prepares reports, and holds read permission only. An actor creates orders, sends messages or edits records, so it gets a narrower scope and approval steps.
Start every new agent as a reader for the first few weeks and compare its drafts with what your team would have done. Our guide to scoping an AI pilot shows how to measure that. Avoid one combination in particular: an agent that can read your whole customer database and also send anything outside the company. If a malicious email or web page tricks it, that agent can leak the data on its own.
Keep a log of what every agent did
When an agent changes a record, you need to see it the same day. Ask for one log entry per action, written so a non-engineer can read it:
When and which agent: the time, the agent's name and its version.
What started it: the email, order or schedule that triggered the run.
What it read: the records it used to decide.
What it changed: the system, the record, and the values before and after.
Who approved it: a named person, or "within limits" for actions taken alone.
Keep the log where the agent cannot edit or delete it. OWASP's advice is to log and monitor the activity of the agent's connections and the systems behind them, because a log limits the damage and shows you a problem early.
Set approval steps for payments and customer messages
Decide which actions an agent may take alone and which wait for a person. A workable starting rule:
Always needs a named approver: payments, refunds, changes to bank details or prices, deleting records, anything with legal wording, and the first message to a new customer.
May act alone: internal notes, drafts, labels, reminders from an approved template.
An approval only protects you if the approver sees exactly what will change before saying yes, and someone is named to cover when they are away. Our guide to human-in-the-loop AI explains how to stop approvals turning into a rubber stamp.
Review agent access every quarter
Access grows quietly. A quick fix in week three becomes a permanent permission by month six. Put a review in the calendar every quarter and work through six steps.
List every agent and its owner. Any agent with no owner is switched off until someone claims it.
Remove agents nobody uses.
Compare each agent's permissions with its job today and cut what it no longer needs.
Read ten recent log entries per agent and check each one made sense.
Rotate the agent's credentials.
Reassign agents whose owner has changed role or left.
Questions to ask your software partner about agent security
Does each agent get its own account, and who is its named owner?
Can you show its permissions inside our systems, not on a slide?
How do you separate agents that read from agents that change records?
What is logged and where, and can the agent edit its own log?
Which actions need human approval, and who covers when that person is away?
How are the agent's credentials stored and rotated?
How fast can we switch an agent off, and what happens to work in progress?
Which of our data goes to the AI provider, and what do its terms say about training? Our guide to AI data privacy explains what to look for.
Where to start with AI agent access control
You do not need a platform to begin. List the agents you run or plan to run, give each its own account and a named owner, and turn on logging and approvals for anything touching money or customers. Then put the quarterly review in the calendar.
Our AI agent development team builds agents with their own accounts, least-access scopes and action logs from the first release. Book a call and we will walk through the access plan for your first agent with you.
