What Should You Define Before an AI Agent Touches Your Systems?

Your team has moved past asking whether AI can draft an email. 

The question on the table now is whether it can update the CRM, route the ticket, pull the account history before a call, or answer the customer directly, and every one of those means handing software access to systems that hold your customers' information.

An agent with that access is a user of your systems. 

It logs in somewhere, reads records, and changes things, which means it needs what any other user gets before their first day: a defined job, a set of permissions, and someone accountable for what it does. 

Companies are skipping that step because the technology arrived as a chat window and chat windows never needed one.

‍

Why is a prompt not enough to control an AI agent?

A prompt covers the request in front of you. 

The agent keeps operating after that, on requests you never see, and everything it does in those runs still belongs to your company.

On February 14, 2024 a British Columbia tribunal decided Moffatt v. Air Canada. 

The airline's chatbot had told a grieving customer he could apply for a bereavement discount within ninety days of purchase, which was never the policy. 

Air Canada's defense argued that the chatbot was a separate legal entity responsible for its own actions. The tribunal rejected that, found negligent misrepresentation, and awarded him about $650 CAD.

Whatever your agent says or does, your company said or did. That is why the job gets written down before the access gets granted.

‍

What levels of authority can an AI agent have?

An agent can hold four levels of authority, and the one you grant decides how much can go wrong before a person sees it:

• Read. The agent retrieves information, summarizes it, compares records, explains what is already in the system.
• Recommend. It suggests an action, drafts a response, flags something for attention.
• Act with approval. It prepares the update, routes the ticket, creates the draft record, and a person releases it.
• Act on its own. It completes a narrow task where the rules are unambiguous and the downside is contained.

An assistant that summarizes support tickets is doing a different job than one that closes them, and a CRM helper that drafts follow-up notes carries different risk than one that moves deal stages. 

Companies tend to demo at the read level and deploy at the act level without deciding anything in between. 

Pick the level for each task and name the person who can change it.

‍

How do you set permissions for an AI agent?

Agent permissions should work the way employee permissions do, with one extra question on top: whose authority is the agent using?

Uber runs thousands of internal agents in production and defines one as "an entity that is authorized to act for or in the place of another." 

Its systems mint short-lived tokens carrying an actor chain, so every call records the original user along with every agent that handled the request on the way. 

Without that chain, agents delegate to other agents and the provenance drops off, which takes the audit trail and any fine-grained policy downstream with it.

The same decisions sit underneath that machinery, and they have to be made before an agent gets a credential:

• Which data it can see, and which customer records stay out of reach
• Which teams can invoke it, and whether that changes by role
• Whether it acts as the requesting user, as the system, or under its own identity
• What it can never do regardless of who asks

‍

Where should the source of truth live for an AI agent?

The source of truth belongs outside the agent, in a decision the business makes and writes down. 

An agent pulling from the CRM, the billing system, and the help desk will encounter disagreement between them, and without a rule it will pick one and sound equally confident either way.

This is ordinary systems design work that predates AI by decades. Customer status lives in the CRM. 

Payment status lives in billing. When we built MyMedGas for BeaconMedaes, the platform layered onto infrastructure that was already the authority for what it tracked, because moving the source of truth is a much bigger project than reading from it. An agent can retrieve and summarize what your systems hold. 

Deciding which system holds the authoritative version is a business decision, made once and documented.

Give the agent a ranking, a staleness limit, and an instruction for what to do when two systems conflict, which is usually to stop and ask.

‍

Which agent actions need a human in the loop?

An action needs a person in the loop when a wrong answer costs money, access, compliance standing, or a customer relationship. 

Approval slows work down, so spend it where the consequence justifies it.

• Low risk, let it run: internal summaries, reformatted notes, suggested tags, related-record lookups, classification of routine requests.
• Medium risk, review before it leaves the building: drafted customer responses, proposed ticket routing, prepared CRM updates, account summaries ahead of a call.
• High risk, a person decides: pricing, permissions, refunds, billing changes, closing a customer issue, anything that commits your company to something.

Real work is full of incomplete records, ambiguous requests, and customers who do not fit the normal path, so define what the agent does when it hits one. 

Routing to a person or preparing a draft it cannot send both beat a confident guess, and the stopping rule belongs in the job description with everything else.

‍

What should an AI agent's activity log capture?

An agent's log should capture everything you would want to know if a customer calls in three months asking why something happened. 

The 2026 MCP roadmap files audit trails, SSO-integrated authentication, and gateway behavior under enterprise readiness, which is a polite way of saying the infrastructure is not there yet and enterprises need it.

A workable log records who requested the action, what the agent read, what it recommended, what it changed, which sources it used, whether a person approved it, when it happened, and whether it was later corrected. 

That list is longer than what your systems capture for human users today, and agents earn the stricter standard by operating faster and at higher volume than any person.

We build audit trails into admin tools and portals as a matter of course, because we believe that business is built on transparency and trust, and that good software is built the same way. 

An agent your team cannot inspect after the fact is one your team will stop using the first time it does something surprising.

‍

What should you define before an agent gets tools?

Work through these before granting access, and put the answers where the next person can find them:

• The job. One named responsibility the agent is accountable for.
• The users. Who can invoke it, and whether that varies by role.
• The systems. Which tools, records and documents it reaches.
• The data boundaries. What stays off limits even inside a system it can access.
• The actions. Reading, recommending, drafting, updating, sending, deleting, escalating, kept separate from each other.
• The approval path. Set by consequence.
• The source of truth. Which system wins a conflict.
• The log. What gets recorded and who can read it.
• The fallback. What happens when it is blocked or unsure.
• The owner. A person who updates all of the above as the workflow changes.

Testing belongs here too, against the messy cases rather than the demo path. 

Missing records, duplicate customers, conflicting statuses, restricted users, and requests that do not parse are where an agent either holds up or embarrasses you.

‍

How should leaders decide what to automate with AI agents?

Ask what authority you are prepared to grant, and what has to be true before you grant it. "What can we automate?" gets an enthusiastic answer from everyone in the room, and it skips the part that determines whether the thing works in production.

Pick the agent your team is closest to deploying and write its job description in a single page, using the ten items above. 

If you cannot fill in the source of truth or the approval path, you have found the work that comes before the agent.