AI agents at work: permissions, approval gates, and human handoffs
Give an AI agent the narrowest permissions needed for a defined workflow, require human approval before consequential actions, and make the handoff explicit when the agent reaches a boundary.
That model matters because agents do more than generate text. They can read systems, call tools, update records, send messages, and trigger downstream work. Microsoft’s May 5, 2026 Work Trend Index surveyed 20,000 AI-using knowledge workers across 10 markets and found that 86% of respondents treated AI output as a starting point they still review and refine. [1]
The practical implication is straightforward: the agent can prepare and propose, but the responsible human still decides when the action matters.
Start with an authority ladder
Use a small number of permission levels so teams can reason about risk consistently.
Level | Agent may do | Human control |
|---|---|---|
Read | Retrieve approved records or documents | Access is limited by role, source, and data type |
Draft | Prepare a response, summary, classification, or recommendation | Human reviews before external use or record change |
Propose | Suggest an update, assignment, discount, or next step | Human accepts, edits, or rejects the proposed action |
Execute reversible action | Perform a low-risk action that can be undone | Rules, logs, limits, and owner are defined in advance |
Execute consequential action | Send externally, change terms, close a case, issue money, or alter access | Named human approval is required immediately before action |
Blocked | Perform prohibited or undefined actions | Agent stops and hands off with context |
Start every design conversation with one question: “What is the worst plausible action if the model is wrong?”
Define the owner before the agent goes live
Every agent needs four named roles:
Business owner: accountable for the outcome and whether the workflow should exist.
Technical owner: accountable for integrations, permissions, testing, and changes.
Human approver: authorized to approve the specific action types the agent can propose.
Escalation owner: receives cases the agent cannot safely resolve.
One person may hold more than one role in a small company, but the responsibilities still need to be written down.
NIST’s AI Risk Management Framework is voluntary guidance intended to help organizations manage AI risks. Its 2024 Generative AI Profile can support this kind of inventory, risk review, and control design. [2]
Three practical workflows
Operations: reporting and vendor follow-up
An operations agent may read approved project updates, identify overdue items, draft a weekly summary, and propose follow-up tasks.
It should not:
Change a financial forecast without an owner’s review.
Approve a vendor commitment.
Send a message that represents an executive decision.
Access documents outside the defined workspace.
The human handoff should include the source records, the agent’s assumptions, unresolved questions, and the proposed next action.
Customer support: triage and response drafts
A support agent may classify tickets, retrieve approved knowledge, draft a response, and route an issue to the right queue.
Human review is required when the case includes:
A refund, credit, contract exception, or legal threat.
A safety, privacy, or security concern.
A vulnerable customer or sensitive personal information.
A response that conflicts with policy or available evidence.
The support owner should be able to see both the draft and the reason the agent stopped.
Sales: research and outreach preparation
A sales agent may summarize account information, identify relevant public signals, prepare a call brief, and draft outreach for review.
It should not invent customer facts, make an unapproved commercial promise, send high-volume outreach without controls, or change a customer record without a defined rule and audit trail.
The approval request should identify the target, source evidence, message, intended audience, and any claims that need human verification.
Design the approval gate as a real decision
A real approval gate shows the approver exactly what will happen. The request should include:
Action: what the agent wants to do.
Target: which customer, record, account, or system is affected.
Inputs: the source material used.
Proposed output: the exact message or change.
Risk: what could go wrong and who could be affected.
Undo path: how the action can be reversed.
Approver: the human authorized to decide.
If an approver cannot understand the action quickly, the agent should not execute it.
Log the full handoff
For each consequential workflow, retain enough context to answer:
Which agent version acted?
Which permissions were active?
What information did it retrieve?
What did it propose?
Who approved, edited, or rejected it?
What happened afterward?
Was an exception or escalation created?
The log should respect the organization’s retention and privacy requirements. Protect the logs with the same access controls as the source data.
A safe rollout sequence
Start with read and draft permissions. Test the agent on representative work. Add proposal rights only after the team can identify common failure modes. Allow reversible execution only when limits, monitoring, and ownership are clear. Keep irreversible or externally consequential actions behind a human approval gate.
The objective is useful autonomy inside a boundary the organization can supervise.
FAQs
Should every agent require human approval?
Every consequential or externally visible action should have an appropriate human control. Low-risk read, draft, and reversible actions can use pre-approved rules if their boundaries are clear.
What is least privilege for an AI agent?
It means granting only the data access, tools, and action rights required for the defined workflow, with no automatic access to unrelated systems or sensitive information.
When should an agent hand off to a person?
When it reaches a defined risk category, lacks evidence, detects conflicting instructions, encounters sensitive data, or cannot explain the proposed action confidently.
Who owns the agent after launch?
The business owner remains accountable for the workflow, while the technical owner maintains the implementation and permissions. Both need an escalation path.
A well-governed agent makes the human’s decision easier to see, review, and improve.
Hire people who work well alongside agents
Agents need people who can review their output, own the approvals, and improve the workflow over time. Crossbridge places operations, support, sales, and engineering professionals who already use AI in their daily work. Our talent team interviews every candidate, you see 3 to 5 vetted profiles per search, and there is no upfront cost.
Get candidates for your open role or see how Nearshore Staffing works.