AI agents are beginning to move from experimental phases into real enterprise workflows. This is certainly a big step forward; however, it also alters the control problem. With a chatbot, much of the risk centers on what the system says. With an agent, the risk shifts to what the system can do. The most concerning part is that they can do all of this using legitimate credentials and fully authorized interfaces.
This is why traditional IAM (Identity and Access Management) controls can create a false sense of comfort. While a credential may be valid, the actions performed with it may be misaligned with the purpose for which access was approved.
Although organizations like CoSAI and OWASP are helping improve the industry by developing better frameworks for agentic systems, most organizations can’t wait for all standards to be finalized before they begin deploying agents. A recent Cloud Security Alliance survey, commissioned by Oasis Security and conducted with 383 IT and security professionals, found that fewer than 25% of organizations have documented and formally adopted policies for establishing or removing AI identities. For audit, risk, and security teams, this raises a practical, simple question: What is the minimum evidence required to approve a production AI agent? Here are four questions worth asking now.
Question 1: Can You Trace the Full Delegation Chain?
A person asking an agent to perform a task does not mean the agent will carry out each stage itself. The agent may contact another agent, use a tool, use an application, or move to a third-party service. Each handoff can change the risk profile.
Before an agent goes live, ask for a delegation map. This map should show which agents can call which other agents or tools, where trust boundaries are crossed, the credentials used at each stage, and any potential scope narrowing as the work progresses. A good way to evaluate this is to choose a single workflow that has been completed and attempt to follow the final task back through all the steps to the initial human request.
Question 2: Do You Know Which Tools the Agent Can Invoke?
Agents often choose what tools to use based on prompts, schemas and context. Therefore, the specific tools available to them are more than just a developer configuration detail; they are a governance issue.
As such, the most reasonable solution is an approved tool registry for production agents, managed with the same rigor as a third-party software onboarding process. Each approved tool should have an owner, a business reason, a data-access profile, known side effects, an approved version and a review date. The review should also look for tool poisoning risk by asking who published the tool, whether the approved package is pinned, whether descriptions or schemas contain hidden or unusual instructions, whether permissions are limited to what the tool actually needs, and whether future updates will trigger a fresh review before production use.
Question 3: Are You Monitoring Exercised Scope, Not Just Authorized Scope?
In a human IAM, a reasonable assumption is that an authorized scope and exercised scope are more or less the same. If an individual has access to a system, it is reasonable to assume they will use it in line with their job role. Agents challenge this assumption because they make autonomous choices about the use of access granted to them.
Consider an agent with authorization to draft replies to support tickets. This agent attempts multiple actions to improve the quality of its responses, pulling customers’ purchase history, performing a billing cross-reference and checking the logs for complaints. While each of these actions may be achievable with the current credentials, the agent has done far more than draft a reply. The access was granted, but behaviorally, no one signed off on this.
This is why monitoring must cover all the actions that the agent actually performed, and not just the ones that the agent was allowed to do. The logs need to capture tool invocations, which data domains were accessed, all write actions, all actions involving sensitive data and all exceptions they may trigger. An alert must be triggered if an agent steps beyond the authorized boundaries, even when the credentials used are valid. It is then up to the auditor to determine if the action was within the intent for which the agent was approved.
Question 4: Is There a Minimum Baseline for Production Agents?
Many organizations are building agent controls one team at a time. One team keeps track of ownership very carefully. Another sends out an agent whose credentials are unclear, with insufficient logging and no retirement plan. The inconsistency is its own risk.
Production approval should only be granted to agents that have a basic governance record. That record should specifically outline what the agent is, its current owner, what it is intended to do, and where it sits in its lifecycle. It should also provide guidance on how the agent delegates work, which tools it is allowed to use, its permitted and prohibited actions, how activity will be logged and monitored, how exceptions will be handled, and how the agent will eventually be retired and deprovisioned.
In highly regulated environments, that baseline is only a starting point. If an agent can influence financial reporting, access customer data, manage regulated processes or issue executive attestations, the organization should also define evidence retention, periodic operating-effectiveness testing and escalation paths for material failures. For much of this work, frameworks such as COBIT already provide useful control language. The challenge is in applying these to a new kind of identity: one that can act with a degree of autonomy.
Agents as Accountable Identities
AI agent governance does not need to begin with a large framework or a long control catalog. A better starting point is to agree on a few expectations that can actually be tested. The four questions discussed in this article should not slow adoption. Instead, they are meant to make adoption sustainable and safer to scale.
Successful organizations will not be the ones that grant agents more access and simply hope the model behaves and makes the right choices. They will define agents as accountable identities, preserve evidence at each action boundary, and build control systems that capture who performed the action, why the action was allowed, and who owns the outcome.
