An agent can inherit authority from a user, service account, API token, connector or another agent. Its written role may therefore be narrower than its effective permissions. Governance must reconstruct what the agent can actually reach and do.
Give the agent a governable identity
A distinct workload identity makes activity attributable and revocable. Shared credentials weaken both control and evidence. Buyers should ask whether agent actions can be separated from the human who initiated the task and from the platform that executed it.
Map effective authority
Review direct permissions, inherited group access, delegated user rights, connected tools and the permissions of downstream services. Then distinguish read, create, modify, approve, publish and delete actions. The result should be a map of possible action, not only configured intent.
An employee asks an agent to prepare and send a customer message. Show which identity reads the data, which identity drafts the content, who approves it and which control can stop transmission.
Design bounded autonomy
- Use least-privilege tool access and short-lived credentials.
- Require approval for irreversible or high-impact actions.
- Limit transaction size, destination and frequency.
- Separate planning from execution where practical.
- Log the request, decision, tool call and result.
Treat change as a new decision
New tools, connectors, prompts, models and delegation paths can materially expand authority. A governance platform should detect or record these changes and trigger reassessment rather than assuming an old approval still applies.