The first wave of workplace AI was conversational. Someone asked a question, the tool produced an answer, and a human decided what to do with it. If the answer was wrong, a person still had to act on it before any harm was done.
That buffer is disappearing. AI agents are now connected to email, calendars, ticketing systems, code repositories, finance platforms and customer records. They can read a request, decide on the steps and carry them out: issue a refund, update a supplier's bank details, close a ticket, change a configuration. The human may only see the result afterwards, if at all.
For auditors, this changes the central question. It is no longer only whether the AI's output is accurate. It is who allowed this software to take this action, under what limits, and how we would know if it went wrong.
Why agents are different
Traditional automation follows fixed rules written in advance. You can read the script and know exactly what it will do. An agent decides its own steps at run time, based on instructions written in plain language and on whatever content it reads along the way. Two runs of the same task can take different paths.
That flexibility is the value, and also the risk. An agent can be misled by content it processes, such as an email or web page containing hidden instructions. It can combine permissions in ways nobody anticipated. And because it works quickly and at scale, a single bad decision can repeat hundreds of times before anyone notices.
What auditors should look at
1. Inventory and ownership
Start by finding the agents. They appear in vendor platforms, productivity suites, developer tools and pilots run by individual teams. Each one should have a named business owner who is accountable for what it does, not just a technical team that set it up.
2. Identity and access
An agent is a user of your systems and should be treated like one. Does it have its own identity, or does it borrow a person's credentials or a shared service account? Are its permissions limited to the task, or did it inherit everything its creator could do? Least privilege matters more for software that never gets tired and never hesitates.
3. Human approval for consequential actions
Not every action needs a person in the loop, but some must. Payments, changes to bank details, deletion of data, messages to customers and changes to production systems should require explicit human approval before the agent proceeds. Test whether that approval is enforced by the system, or only described in a policy.
4. Logging you can actually use
For each action, you should be able to reconstruct what the agent was asked to do, what it read, what it decided and what it changed. Without that trail, investigating an incident or answering a regulator becomes guesswork. Check that logs are retained, protected from alteration and reviewed.
5. Limits and a stop button
Agents should operate within limits on value, volume and scope, with alerts when they approach them. Someone should be able to suspend an agent immediately, and the organisation should know how to reverse what it has done.
6. Testing before and after go live
Ask how the agent was tested, including against attempts to manipulate it through the content it reads. Then ask how its behaviour is monitored after launch, because agents change when the underlying model, instructions or connected tools change.
Four questions for leadership
- How many AI agents can take actions in our systems today, and who owns each one?
- Which actions can an agent take without a human approving them first?
- If an agent made a harmful change, how quickly would we detect it and undo it?
- Who is accountable when an agent acts wrongly: the vendor, the developer or the business owner?
AI agents can remove a great deal of routine work, and organisations that use them well will move faster. But software that acts on its own needs the same discipline we apply to people with access: a clear identity, limited rights, approval for what matters, and a record of what it did. Auditors who ask these questions now will help their organisations adopt agents with confidence rather than discover their risks through an incident.