What Leaders Need in Place Before AI Agents Take Action

Before an AI agent can update customer records, publish content, or change account access, someone needs to decide what it’s allowed to do. That decision belongs in the implementation plan, alongside the business outcome and the people responsible for it.

AI agent governance makes those decisions explicit. Who owns the agent? Which actions can it take? When does a person need to approve? What happens when the work goes wrong?

SailPoint’s identity-security announcement this week gives leaders a useful reason to answer those questions now.

The leadership question behind this week’s news

On October 6, SailPoint announced expanded agent identity controls at Navigate 2026. Its announcement describes discovering agents, checking authorization during execution, limiting standing access, and stopping agents when needed. SailPoint says capabilities are rolling out beginning at Navigate. Some announced products, including A-ISPM and the Harbor Pilot Policy Agent, are expected in Q4 FY27.

RSA’s Agent ID announcement, first published September 29, reflects a similar emphasis. RSA describes registering agents with named owners, checking policy on each tool call, requiring authenticated human approval for high-risk actions, and reviewing access over time. Discover and Secure are scheduled for general availability on November 16, 2026. Govern is scheduled for the first half of 2027.

These are vendor descriptions and release plans. They don’t establish how well either approach will work in your environment.

The useful takeaway is the set of questions they raise for buyers. A product can help enforce the rules. Your leadership team still needs to decide what those rules should be.

Give each agent a business owner

Start with the workflow the agent supports and the person accountable for its outcome.

For a lead-follow-up agent, that might be the sales operations leader working with the sales manager and technical team. The owner should understand what a good result looks like, how a mistake affects a customer, and when the workflow needs to change.

Keep a simple record of the agent’s purpose, connected systems, permitted actions, owner, and next review date. Include a backup contact for problems that happen while the owner is unavailable.

This fits the NIST AI Risk Management Framework’s guidance on inventories, clear responsibilities, and ongoing review. The framework is voluntary. The recommendations here are a practical starting point, not a statement of the legal requirements for every business.

Ownership needs time attached to it. If someone is responsible for an agent but has no capacity to review problems or improve the workflow, the job hasn’t been fully assigned.

Set permissions around the specific task

Consider a hypothetical agent that prepares a weekly customer summary. It may need to read selected account records and create an internal draft. Giving it permission to delete records or email the entire customer list adds exposure without helping that task.

OWASP’s guidance on excessive agency recommends limiting available tools and permissions, requiring human approval for high-impact actions, and enforcing authorization in the connected systems rather than relying on the model to decide what is allowed.

Ask your implementation team to demonstrate the boundaries:

• Which records can the agent read and change?

• Which destinations can receive information?

• What volume or spending limits apply?

• What happens when a requested action falls outside those limits?

Instructions written in a prompt need technical controls behind them. A test should show that an out-of-scope action is blocked, including when a document or message asks the agent to ignore its instructions.

This is work to include when designing agentic workflows, before expanding a pilot into more systems.

Make human approval useful

Human oversight needs a clear decision attached to it. A reviewer should see the proposed action, affected records or recipients, supporting information, and likely consequence before approving.

For example, a proposed customer credit should show the account, amount, reason, and relevant policy. A content approval should show the final copy and where it will appear. Those details give someone a fair chance to catch a problem.

Choose approval points according to the consequence. Routine, reversible work may fit within preapproved limits. Decisions involving significant spending, sensitive information, public claims, or changes to someone’s access deserve closer review.

Also decide what happens when nobody responds. A pending approval should have a defined timeout and escalation path. Reviewers need the authority to decline, ask for evidence, or pause the work without being treated as an obstacle to adoption.

Measure the review burden. If people are approving a stream of repetitive requests, redesign the task or narrow the permissions so attention goes where judgment matters.

Test how the team stops and recovers

Before launch, ask someone to walk through a failure. Suppose an agent changes the wrong set of customer records. Who notices? Who can suspend access? Can the team identify the affected records and restore the previous values?

NIST includes the ability to disengage or deactivate a system and plans for incident response and recovery in its risk management guidance.

Your test should produce evidence that the controls work. Keep a record of actions and approvals, with appropriate protection for sensitive information. Check that stopping one agent doesn’t leave a scheduled process continuing the same work elsewhere.

Some actions can’t be fully undone. A sent message may already have been read. That makes the decision before execution especially important.

Five decisions to make before the next pilot

Bring the workflow owner, a frontline user, and the technical or security lead into the same conversation.

1. Choose one useful outcome. Define the task and how you’ll measure improvement. Include accuracy, customer impact, and review time alongside speed.

2. Write down the permitted actions. Separate reading, drafting, changing records, and communicating externally. Give each action a clear boundary.

3. Assign the human decisions. Name the approver, the evidence they need, and what happens if approval is delayed or declined.

4. Run a failure test. Try an out-of-scope request, an unavailable approver, and a bad input. Verify the stop and recovery process.

5. Set the next review. Revisit access when the owner, connected tools, or purpose changes. Expand the pilot only when its results justify the additional responsibility.

Human-led AI gives people a deliberate role in how work happens. Clear authority lets a team use automation with a shared understanding of where judgment is still required.

If your team needs help setting that direction, explore HiVoltage’s fractional CAIO support. Start with one task, its owner, and the decisions that need to stay with your people.