Why AI agents need controls before they act

As businesses give AI agents greater responsibility for executing work, traditional approaches to oversight may no longer be sufficient. Speaking at IFS Unleashed in Orlando, Cathie Hall explains why governance must operate throughout an automated process rather than simply record what happened afterwards.

An AI assistant recommending that a company purchase a replacement component can be challenged before an order is placed. An AI agent authorised to initiate the transaction may also interact with inventory systems, update business records and trigger subsequent activities, potentially spreading the consequences of an incorrect decision across several applications. As organisations move towards AI systems that perform work rather than simply provide information, questions about permissions, accountability and operational control become considerably more demanding.

Cathie Hall, Chief Product and Customer Officer at IFS, believes businesses must reconsider how they govern intelligent systems as those systems take on responsibilities traditionally assigned to employees. Speaking during a press briefing at IFS Unleashed in Orlando, she explained that enterprise AI needs to operate within the same rules that determine what employees can access, approve and change. The company’s launch of its Industrial AI Harness provides an example of how these requirements are being incorporated into the architecture of agentic software.

The issue extends well beyond the reliability of an AI model’s responses. Enterprise agents increasingly need access to operational records and the ability to initiate transactions, meaning an incorrect action can affect processes that are already underway. For businesses managing complex assets, supply chains or critical services, discovering a mistake after it has been executed may leave employees with substantial work to correct it.

Giving AI agents the right permissions

Enterprise applications have long relied on permissions to restrict employees to the information and activities appropriate to their responsibilities. A purchasing employee might be authorised to raise a requisition but require additional approval before committing the business to a substantial expenditure. As companies introduce AI agents into these processes, those established distinctions need to be reflected in the authority granted to software.

Hall argues that agents should not acquire broader access simply because they interact with systems through a different interface. The rules governing employees provide a starting point for determining which records an agent can examine, which transactions it can initiate and when a separate authorisation is required.

“When agents are acting on behalf of people, it becomes incredibly important that they have the same level of governance and access controls,” she explains. “How are they accessing the system of record? What is the audit trail? How do we know what they are allowed to do? We need to give permissions to an agent in the same way that we give permissions to a human.”

The difficulty increases when businesses deploy agents from different suppliers or allow several intelligent systems to collaborate. An individual application may have its own security arrangements, but those controls need to remain effective when a task passes between applications. Without consistent rules, responsibility for an action could become difficult to establish, particularly when several agents contribute to completing a workflow.

IFS has designed its Industrial AI Harness to apply permissions and business rules to activity passing through IFS Intelligence, including interactions involving supported third-party agents. According to the company, the system inherits access restrictions from connected enterprise applications, preventing an agent from seeing information or performing actions beyond those authorised for the signed-in user.

Hall sees interoperability as an important requirement, provided it does not create exceptions to established controls. “We want customers to have options and to bring in different systems, different capabilities and different digital workers,” she says. “But we need to make sure that every one of those entry points has the same permissions, the same business rules and the same audit trail as the people working in the business.”

Governance cannot wait until the task is finished

Conventional oversight often relies on reviewing activities after they have occurred, using transaction logs and audit records to establish who changed information and when. These remain important for accountability, but they cannot necessarily prevent an inappropriate automated action from affecting an operational process. Hall argues that AI governance must influence how work is performed at every stage.

The Industrial AI Harness combines six functions covering planning and orchestration, skills and system connections, memory and context, permissions, verification and escalation, and auditability. Together, they are intended to determine how an agent approaches a task, which information it can use and whether its proposed actions comply with the organisation’s requirements. When a task requires additional judgement or approval, the system is designed to involve an employee before proceeding.

For Hall, recording an error after its consequences have spread through the business is an inadequate substitute for controlling the actions that produced it. “It cannot be a case of anything being allowed to happen because we have an audit trail at the end,” she continues. “Governance must be built into every step. We need to make sure the right skills and connectors are being used, that the information is correct and that verification and escalation work predictably every time.”

This approach requires agents to operate with more than a general understanding of their objective. They must be able to identify which systems are relevant, maintain sufficient context as work progresses and recognise when an action exceeds their authority. A task that begins with retrieving information may eventually require a transaction affecting another department, creating an additional point at which permissions or approval could become necessary.

The challenge becomes particularly significant when workflows span several enterprise systems. A digital worker might retrieve information from one application, interpret it using another capability and request an action in a third. Each stage introduces dependencies that businesses need to understand if automated execution is to remain predictable.

How much autonomy should an agent have?

Businesses are showing increasing interest in digital workers, although enthusiasm for automation does not necessarily translate into confidence that agents should operate independently. Research cited by IFS at Unleashed found that 43 per cent of surveyed industrial organisations had introduced agentic digital workers into everyday operations during the previous year. However, only 11 per cent reported validating AI outputs for safety, quality or mission-critical processes.

Those findings suggest that operational adoption and formal safeguards are developing at different rates. They also raise questions about how businesses determine which activities are suitable for autonomous execution and which require continued human involvement. The appropriate answer is likely to depend on the consequences of a mistake, the reliability of the available information and the authority required to complete the task.

IFS describes an approach in which agents can progress from assisting employees to recommending actions and, where authorised, executing them. The company says its framework provides for escalation when an agent encounters uncertainty or needs a decision beyond its permitted responsibilities. That makes human intervention part of the operating process rather than an exceptional response to a system failure.

Hall emphasises the importance of understanding when an automated process needs additional expertise. “We must make sure we are following the rules and guidelines, bringing a human into the process when an agent starts to deviate from them, when a decision is needed or when more experience is required. The verification and escalation must work predictably, and the permissions cannot apply in some circumstances but not in others.”

The technology also needs to accommodate differences between organisations. A process considered suitable for automated execution in one business may require several approval stages in another, depending on the nature of its operations and regulatory obligations. Governance therefore needs to be configured around actual business responsibilities rather than treating every workflow as if it carries the same level of risk.

The Industrial AI Harness represents IFS’s proposed architecture for addressing these requirements, although the effectiveness of its controls will ultimately depend on how they perform in live customer environments. Organisations will need to examine whether agents consistently respect permissions, whether escalation works under unexpected conditions and whether records provide sufficient detail to reconstruct decisions when something goes wrong.

As agentic AI becomes more deeply embedded in enterprise operations, businesses will have to establish clearer boundaries around the authority they delegate to software. Greater automation may reduce the work employees perform directly, but it also increases the importance of deciding where human judgement and accountability remain necessary.

Hall’s argument places those decisions at the beginning of AI deployment, before intelligent systems are permitted to act on business information. For companies moving beyond experimentation, defining what an agent is allowed to do, and ensuring those limits remain effective throughout execution, will be essential to making autonomous workflows dependable.