AI Operating System for Companies

Permissions, approvals and audit for company AI agents

Three controls decide whether an AI agent is safe to let loose on company records: what it can access, what it can do without asking, and whether anyone can see afterwards what it did.

By The editors · Updated · 4 min read

A compliance officer reviews a printed access-log binder with a pen while a colleague from IT leans in and points at a line.
An audit trail is only useful if someone outside IT can read it.
Contents
  1. The problem in numbers
  2. Control one: access
  3. Control two: approvals
  4. Control three: the audit trail
  5. Writing the policy
  6. Questions buyers ask
  7. Sources

When AI only answers questions, a mistake costs a bad paragraph. When an agent sends the email, places the order or changes the record, a mistake costs money, a customer or a compliance finding. The controls that separate the two are not new; they are the same ones companies already apply to people.

The problem in numbers

IBM's 2025 breach study found that 13% of the 600 organisations studied had suffered breaches of AI models or applications, and that 97% of those lacked AI access controls. Sixty-three per cent of breached organisations had no AI governance policy or were still developing one, and those with high levels of unsanctioned AI paid $670,000 more per breach on average⁠1.

For companies operating in the EU, the AI Act adds legal weight for some uses. High-risk systems, a category that includes AI for employment and worker management such as CV-sorting software, must provide logging of activity for traceability and appropriate human oversight; those obligations apply from 2 December 2027⁠2.

Control one: access

There are two models for what an AI can see and change.

  • Delegated access. The AI acts with the permissions of the person using it. Microsoft scopes Copilot access by user permissions⁠3, Gemini Enterprise runs under each person's existing permissions⁠4, and Glean enforces source-system permissions on every read and write⁠5. This is right for assistants.
  • Task-scoped access. The agent has its own role with only what its job requires. OpenLazarus describes AI teammates that each see only what their task needs, with access following the roles the company sets⁠67. Glean's security page makes the same point from the other direction: agents should not automatically reach everything a user can⁠5. This is right for agents that act without a person present.

Control two: approvals

A three-tier rule for every agent task

  • Handle alone: routine, reversible actions inside clear limits, such as filing a document or sending a standard reminder.
  • Ask first: actions above a threshold or that change a commitment, such as an order over a set value or a new delivery date.
  • Never: actions reserved for people, such as decisions about hiring, credit or legal positions.

Few vendors publish how approvals work. OpenLazarus lets the company decide, per teammate, what is handled alone and what is asked first; its manufacturing page gives a material order over $20,000 or a change to a promised ship date as examples⁠8. WRITER lists approvals among its enterprise features⁠9. Gemini Enterprise lets administrators cap spending per project so the agent pauses instead of overspending⁠4. For the other platforms we reviewed, approval rules were not described on the pages we read; ask for a demonstration.

Control three: the audit trail

PlatformWhat it publishes about audit
GleanEvery control point logged to an end-to-end trail; events can be streamed to a SIEM⁠5
Gemini EnterpriseLeaves a complete audit trail⁠4
Palantir AIPAudit tracking and historical lineage⁠10
WRITERAgent observability and audit logs⁠9
Microsoft CopilotPurview can review Copilot prompts and responses⁠3
OpenLazarusEvery action logged with who, what and when, visible to staff⁠68
Salesforce AgentforceNot described on the trust page we read⁠11

A log that only engineers can read does not meet the need. The people responsible for the work, the department manager and the compliance officer, should be able to see what an agent did on a given record without filing a ticket.

Ask each vendor for a real export of an agent's action log for one day, and have your compliance team read it.

Writing the policy

  1. List every agent and its owner. One named person accountable for each.
  2. Give each agent a role. Write down what it may read and what it may change, by system and record type.
  3. Set the three tiers. For each task: handle alone, ask first (with the threshold and the approver), or never.
  4. Define the log. What is recorded, where it is kept, for how long and who reviews it.
  5. Classify against the AI Act. Flag any use that could be high-risk and apply oversight and logging to it from the start⁠2.
  6. Review monthly at first. Read a sample of the log, check approvals were requested when they should have been, and adjust thresholds on evidence.

The end state is an AI estate that can be audited like any other part of the company: each agent has an owner and a written role, consequential actions wait for a named person, and any action can be traced from the record back to the rule that allowed it. The main comparison shows how each platform scores on these controls.

Questions buyers ask

Should an AI agent have the same permissions as the user who runs it?

For an assistant, usually yes; Microsoft, Google and Glean all scope AI access by the user's existing permissions. For an agent that acts on its own, the safer pattern is narrower: the agent gets only what its task needs, as OpenLazarus describes for its AI teammates, and Glean's own guidance says agents should not automatically reach everything a user can.

What should an AI audit log record?

At minimum who or what acted, on which record, what changed, when, under which rule, and who approved it if approval was required. It should be retained, searchable and exportable to the security team's tools.

Which AI actions should always need human approval?

Anything that moves money above a threshold, changes a commitment to a customer or supplier, deletes records, contacts someone for the first time, or affects an employee or applicant. Set thresholds per agent and relax them only on evidence.

Sources

  1. IBM report: 13% of organizations reported breaches of AI models or applications, 97% of which reported lacking proper AI access controls. IBM Newsroom, 30 Jul 2025. Accessed 8 Nov 2026.
  2. AI Act: regulatory framework for AI. European Commission. Accessed 8 Nov 2026.
  3. What is Microsoft Copilot?. Microsoft Learn, 5 Nov 2026. Accessed 8 Nov 2026.
  4. Gemini for business: the universal work agent. Google Cloud. Accessed 8 Nov 2026.
  5. Security. Glean. Accessed 8 Nov 2026.
  6. OpenLazarus for healthcare practices. OpenLazarus. Accessed 8 Nov 2026.
  7. OpenLazarus for accounting firms. OpenLazarus. Accessed 8 Nov 2026.
  8. OpenLazarus for manufacturing. OpenLazarus. Accessed 8 Nov 2026.
  9. WRITER pricing. WRITER. Accessed 8 Nov 2026.
  10. AIP overview. Palantir Documentation. Accessed 8 Nov 2026.
  11. Trusted AI. Salesforce. Accessed 8 Nov 2026.

Updated 8 Nov 2026: First published.

Further reading