AI Agent Governance: Permissions, Limits, and Who Approves What

AI agent governance is the set of rules that defines what each agent can do, with what limits, and who approves what. While AI only answered questions, governing it was a matter of privacy and little else. As soon as an agent sends emails to customers, creates orders in the ERP, or issues a refund, governance becomes a top-tier operational matter: an agent without limits is a new employee with access to everything and no supervisor. No company would hire a person this way; many are deploying agents exactly like this.

This article describes the governance model we apply when operating agents in production: autonomy levels, permissions, quantitative limits, approval matrix, and auditing. You don't need a committee or a 40-page manual: you need one page per agent and the discipline to keep it up to date.

Why governance matters more when AI moves from responding to acting

A chatbot that makes a mistake generates a bad response; an agent that makes a mistake generates a bad invoice, a duplicate order, or an untimely email to your best customer. The difference is not one of degree, it is one of nature: the error stops being information and becomes an action with consequences for your systems and your relationship with customers and suppliers.

In an AI-first company, where agents execute processes from start to finish and people supervise, governance is not a brake on automation: it is what allows you to go fast without gambling. Clear limits are precisely what give management the confidence to grant more autonomy. Without them, every incident reopens the debate on whether "this AI thing" is reliable, and the project moves forward one fright at a time.

The three levels of agent autonomy

Not all agents should operate the same way. In practice, three levels work, and the golden rule is that every agent starts at the first and ascends with data, not enthusiasm:

• Level 1 — Proposes: the agent prepares the work (a draft response, a pre-filled order, a report) and a person reviews and executes it. Near-zero risk; serves to measure the agent's real quality with real volume.
• Level 2 — Executes with approval: the agent does all the work and leaves it ready for a human confirmation click. The person stops producing and starts validating. This is where most useful agents live during their first months.
• Level 3 — Executes with limits: the agent acts alone within defined thresholds (amounts, volumes, case types) and everything outside the threshold escalates to a person. You only get here with metrics: sustained success rate at level 2 for weeks, not days.

The level increase must be an explicit decision by the process owner, with numbers in front of them. The same applies to a decrease: if the error rate goes up, the agent returns to the previous level without drama. It is a mechanism, not a punishment.

Permissions: what it can read, what it can write, what it can execute

The second axis is system access. It is useful to separate three verbs that are often granted as a block and should not be:

• Read: what data the agent accesses (customers, rates, stock, history). Principle of least privilege: only what it needs for its process, not "the whole database just in case."
• Write: what records it can create or modify (a draft order, yes; the master price file, no).
• Execute: what actions with external effects it can trigger (send an email, charge, launch a shipment). This is the shortest and most closely monitored list.

Two practical rules. First: each agent operates with its own credentials, never with an employee's personal account; if the agent shares a user with a person, auditing is impossible and revocation is too. Second: access is granted through native connectors to your systems, with permissions limited by connector, not with a generic admin user. Revoking an agent's access should take one minute.

Quantitative limits: thresholds, quotas, and schedules

Permissions say what the agent can touch; limits say how much. They are the cheapest part to implement and the one that avoids the most headaches:

• Amount thresholds: a support agent can issue refunds up to €50 alone; above that, a person approves. A purchasing agent can confirm restocks up to €500 per line.
• Volume quotas: maximum emails sent per hour, orders created per day. A faulty loop with a quota is an anecdote; without a quota, it is a crisis.
• Schedules and windows: sensitive actions only during business hours, when someone is available to respond to an escalation.
• Stop button: any manager should be able to pause an agent instantly, without a ticket to anyone. If stopping an agent requires calling the provider, you have a design problem.

Who approves what: the approval matrix

The question "who approves what?" has a short answer: the process owner, not the technical department. IT manages access and security, but deciding if the quote agent can send offers without review is a business decision that belongs to the person responsible for that process.

A minimal matrix fits in a four-column table: action, condition, who approves, maximum response time. For example: "send quote — amount less than €3,000 — no one (level 3) — n/a" and "send quote — amount greater than €3,000 — sales manager — 4 business hours." If the escalation has no deadline, escalated cases pile up and the team ends up approving in bulk without looking, which is worse than having no matrix.

Each agent also needs an owner with a first and last name: the person who reviews its metrics, decides on level increases, and responds when something fails. An agent without an owner is an abandoned agent, and abandoned agents degrade just like abandoned processes. In an AI-managed company, the organizational chart includes this figure from the first agent.

Auditing: let everything leave a trail

Everything an agent does must be recorded: what action was executed, on what data, with what result and, if there was human approval, who approved it. It is not bureaucracy: it is what turns an incident into a twenty-minute diagnosis instead of a week of archaeology.

The review routine is simple: the agent owner reviews a sample of actions every week for the first month or two, and monthly thereafter, along with three fixed metrics — volume processed, escalation rate, and error rate. When escalation drops sustainably, it is a sign that the agent can level up; when errors rise, it means something changed in the process or data and needs to be looked at before it is noticed outside.

How to start without building a bureaucracy

Agent governance is implemented in the same project as the agent, not after. For each agent, one page: what it does, what is forbidden, what level of autonomy it operates at, what quantitative limits it has, who its owner is, and to whom it escalates. Writing it takes an hour; not writing it costs the first crisis.

Our recommendation is to include this page as a mandatory deliverable for every automation, from the first pilot — it is one of the milestones of the 90-day roadmap for implementing AI that we follow with our clients. And if you want to know which processes in your company allow for agents and with what governance, the first step is an automation diagnostic: in a short time you will have the map of candidates, risks, and recommended limits for each one.

Frequently Asked Questions

What is AI agent governance?

It is the set of rules that defines what each agent can do in your systems: what data it reads, what actions it executes, with what amount and volume limits, who approves exceptions, and how everything is audited. It turns agents into reliable operators instead of black boxes with access to everything.

Can an AI agent work without human supervision?

Yes, but only within defined limits and after having earned that autonomy with metrics: weeks of high success rate operating with human approval. Everything that falls outside its thresholds must escalate to a person, and an immediate stop button must always exist.

Who should approve an agent's actions, IT or business?

The process owner, who is the person responsible for its results. IT manages access, credentials, and security, but deciding how much autonomy the quote or customer service agent has is an operational business decision, not a technical one.

How much bureaucracy does governing agents add?

Very little if done from the start: one page per agent with its permissions, limits, owner, and escalation path, plus a monthly review of three metrics. The expensive part is the opposite: deploying agents without rules and paying for governance in the form of incidents.