gettyAI agents can do far more than generate text or summarize information—they can interact with software, retrieve sensitive data and take actions across business systems. That ability can unlock major gains in speed and productivity, but it also raises the stakes when an agent behaves unpredictably, receives excessive access or makes a mistake at machine speed.Before connecting AI agents to production environments, companies need safeguards that address who controls them, what they’re allowed to do and how their activity will be tested, monitored and reviewed. Below, members of Forbes Technology Council discuss the controls organizations should establish before allowing AI agents to access sensitive data, critical workflows or live systems.Require Human Approval Before ExecutionKeep a human approval step between an agent’s recommendations and execution. While AI can analyze, diagnose and propose actions, a qualified engineer should validate changes before they reach production. In large-scale database environments, this simple control often prevents well-intended but risky actions that could lead to outages. - Devendra Rajput, AccentureGrant Task-Scoped, Just-In-Time AccessWe’re inheriting a problem: role-based access control designed for humans. That gap deserves real attention. Human roles are already overprovisioned, accumulated over years and rarely shed. Hand an agent a role and it inherits that cruft instantly. Agents shouldn’t get roles. They should get just-enough, just-in-time access that’s granted for the workflow, then revoked. Think task-scoped, not role-scoped. - Harman Kaur, TaniumForbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?Assign Clear Ownership And AccountabilityAI agents are proliferating because they promise to transform how work gets done. Before granting them access to production systems, organizations should establish clear accountability. Every agent needs defined ownership, operating boundaries and auditable actions. The leading enterprises across industries will be those that can accelerate AI adoption while maintaining trust in the decisions and actions AI takes. - Abhijit Kakhandiki, BMC SoftwareLimit Permissions And Isolate Early TestingEnforce least-privilege access. Give an AI agent only the narrowly scoped, time-limited permissions it needs for a specific task, preferably in a sandbox or nonproduction environment first, and require human approval for irreversible or high-impact actions. This limits the damage if the agent behaves unexpectedly, is manipulated by malicious input or uses credentials improperly. - Jessica Vitiritti, Bank of MontrealDefine The Use Case And Success MeasuresBefore granting an AI agent access, map the exact problem it’s meant to solve and how you’ll measure success. Too many companies grant broad permissions without a clear signal for what “working” looks like. Start with scoped, auditable access, then expand only as usage data proves the agent is actually performing as intended. - Brian Stimpfl, S-DocsSpecify A Human Owner For Every OutputThere must be named human accountability. Before any AI agent touches production systems or business-critical workflows, assign a specific person who owns every output it produces—not a policy, not a committee, but a person. Governance is not a constraint on what you build. It is what makes what you build worth trusting. - Ali Alkhafaji, APPLYBuild A Trusted, Governed Information LayerBefore giving AI agents access to critical systems, companies need a trusted information layer that ensures every decision is grounded in accurate, contextualized information. Agents are only as reliable as the data they use, so organizations must also establish governance controls that define what agents can access, what actions they can take and how those actions are monitored. - Tony Grout, M-FilesMap And Manage Each Agent’s IdentityBefore giving an agent access to production or sensitive data, map its identity: what permissions it holds, what apps and data it can reach, and what it can do with them. Access should be scoped to least privilege, monitored like any other identity and revoked the moment it’s no longer needed. - Ofer Klein, RecoSet Hard Boundaries Before RuntimeLock what an agent can do at build time and enforce that boundary at runtime. A human decides which tools an agent can execute when it’s designed, and the model reasons the order of tools to achieve its goals. Real safety isn’t approving actions after the fact. It’s scoping what an agent can do before it ever runs. - Chris Wade, ItentialTreat Agents As Privileged IdentitiesAI agents must be treated as privileged identities before they touch production. Most organizations have no framework for what an agent can access, who owns it or how its actions are audited. That gap is the attack surface, and it’s exponentially expanding. Enforce least-privilege, just-in-time access with full session accountability, and you close the door attackers are already walking through. - Darren Guccione, Keeper SecurityMonitor Agent Behavior In Real TimeMake real-time analytics part of your organization’s AI harness so that you can detect when agents deviate from intended behavior, access data outside normal patterns, interact with unexpected systems, or cross red lines in terms of unacceptable output. This capability needs to be real-time and alert-driven, since by the time you audit static activity logs, the damage is already done. - Jim Richberg, Fortinet, Inc.Keep Public Models Away From Sensitive DataOur position: We don’t let public LLMs directly touch protected health information or sensitive data. Only internally developed, tightly governed agents should interface with that information. Public models are built for general use, not for the accountability healthcare data demands. - Virgil Bretz, MacroHealthMake Agent Access An Architecture DecisionBefore granting AI agents production access, organizations should require approval gates, least-privilege permissions and auditable actions. Access should be task-specific, time-bound and regularly reviewed, with human approval for high-impact decisions. The safeguard isn’t a tool you buy; it’s the discipline of treating agent access as an architecture and risk decision, not a config toggle. - Jesse Stockall, FlexeraIssue Policy-Bound Cryptographic IdentitiesTo achieve AI trust, companies need to treat AI agents as machine identities. Issuing cryptographic identities with policy-bound authorization, continuous auditability, governance and lifecycle management is the way to verifiably secure agents in production systems. Granting access without strong identity controls is a blueprint for disaster. - Jason Sabin, DigiCert Inc.Require Evaluations And End-To-End ObservabilityNo system should go into production without proper evaluations and observability mechanisms. Evals verify that agents consistently behave as intended across various scenarios. Observability provides traces of prompts, tool calls, decisions and actions, allowing teams to investigate mistakes, identify root causes and continuously improve reliability and safety. - Pawel Rzeszucinski, WebProsDiscover And Classify Accessible DataBefore giving AI agents access to production systems or sensitive data, companies need to know exactly what data those agents can reach. Start by discovering and classifying sensitive data, then map access paths and enforce least privilege so agents only reach what they need. This reduces the chance that an agent exposes, misuses or acts on sensitive data it should never have accessed. - Asaf Kochan, SentraBind Every Agent To A Verified Human OwnerBefore granting AI agents access to production systems, companies must route all activity through an inline control plane that cryptographically binds each agent to a verified human owner. Establishing this upfront control eliminates shadow AI before it gets out of reach, ensuring explicit, timebound authority and real-time oversight to instantly revoke access if an agent strays. - Bojan Šimić, HYPR Corp.Enforce Trust Boundaries Between AgentsDesigning for asymmetric access is critical. In complex agentic systems, low-privilege agents often interact with highly privileged agents, as well as humans with varying levels of entitlement. Unless every agent boundary is treated as a trust boundary and deterministic authorization policies are enforced, such interactions can create opportunities for privilege escalation, where a harmless low-privilege request gains access to high-privilege resources. - Elliott Cordo, Data FuturesEliminate Standing Permissions For AI AgentsThreats come from shadow AI, rogue AI agents and bad actors working at machine speed. Every AI agent needs to be provisioned with least-privilege, just-in-time access and no standing permissions. Overpermissive and/or inherited access creates a far larger blast radius than a single misused login. Provision AI agents with narrow, short-lived, fully logged access, and require human approval for anything irreversible. - Tim Currie, In Balance IT SolutionsRoute Agents Through Existing GuardrailsDon’t reinvent controls for the AI agent. Identify procedures that already work and give the agent a way to accomplish outcomes through those guardrails. For example, there’s already a network-access-request framework that’s proven, vetted and monitored. Rather than letting an agent touch the network directly, give it a path to leverage the existing framework within already governed controls. - Erez Tadmor, Tufin