Enterprises can’t approve what they can’t see, and most can’t see the agents they already have.
Security teams keep arriving at the same question about AI agents: who approves what the agent does before it moves money, touches customer data, or changes production? It’s reasonable, but not the first question, because approval only governs the agents an organization has already found. When Akto deployed discovery tooling on employee endpoints, a single machine carried roughly 400 agent skills, about half of them malicious. Almost none were installed deliberately; they arrived bundled inside AI applications employees had good reason to install. Nobody chose them, so nobody reviewed them, and no approval workflow was going to catch them.
The approval question assumes an inventory most companies don’t have
The same pattern appears in the breach data. IBM’s 2026 Cost of a Data Breach Report found that among the one in five organizations reporting an AI-related breach, 92 percent lacked proper access controls on the systems involved, while only four in ten organizations restrict access to their AI models and data at all. Shadow AI accounted for 43 percent of AI-related incidents, more than double the prior year. These are failures of inventory and permission, not model selection.
The upstream picture matches. Akto’s 2025 survey of more than 100 security and AI leaders found only 21 percent maintaining a complete, current inventory of their agents, MCP connections, and the tools those agents invoke, with 79 percent lacking a governance policy for how agents are permissioned or monitored.
This matters because enterprises handle documented risk competently: legal papers it, insurance covers it, the risk team prices it. Risk that never made a list gets none of that, which is the difference between a broken lock that generates a work order and one that generates an incident.
At scale, human approval stops functioning as a control
Even for catalogued agents, human-in-the-loop is a single control rather than a strategy, and it degrades once agent volume outpaces the people available to review. Cisco began issuing a personal AI agent to each of its roughly 90,000 employees in mid-2026. Routing every action from a population that size through human review would eliminate most of the reason for deploying agents, while producing the fatigue alert volume already produced in a SOC.
People under review pressure don’t stop approving; they approve faster and with less context, leaving a documented sign-off on an action nobody meaningfully evaluated. That is weaker than no approval step at all, because the record now suggests someone checked.
Risk-based autonomy is the workable middle
The model that holds up matches human involvement to what the action does, rather than applying one blanket policy to every agent.
- Low-risk, reversible actions should execute automatically, since putting a person in front of a near-zero-consequence decision spends attention needed elsewhere.
- Medium and high-risk actions should execute inside defined policy boundaries: scoped credentials, spending and transaction limits, tool-level allow and deny rules, without per-action review.
- Critical actions that are irreversible, privileged, or externally consequential require informed human approval, and informed is doing real work there. If the prompt doesn’t tell the reviewer what the action does, what it touches, and what breaks if it’s wrong, the reviewer is guessing, not governing.
Response should also be graduated rather than binary: watch an action, flag it, slow it or sandbox it, and let it proceed fully only once there is reason for confidence. Approve-or-block demands a certainty the system rarely has.
Attribution is the layer teams skip
None of those tiers hold up without attribution: every action, autonomous or approved, tracing back to the agent that took it, the human or system that delegated the authority, and the policy it ran under. Shared credentials break this most often, because an agent operating under an employee’s login leaves investigators guessing whether the agent or the person acted. The alternative is a scoped identity for every agent, separate from any employee’s login, limited to what the task requires: read access to one channel to draft replies, not the whole workspace and inbox. Fewer than half of organizations actively secure the non-human identities their agents run on.
Four steps, in an order that matters
1. Discover. Maintain a living inventory of agents, the tools they invoke, the identities they use, the data they reach, and the business owner for each, updated as agents are built, not once a quarter.
2. Classify. Rank actions by impact, sensitivity, privilege, and reversibility, so risk becomes something policy can act on.
3. Guardrail. Apply least privilege and scoped credentials, and revisit scope rather than storage. Moving a credential into a secrets manager improves how it is held without limiting what happens if the agent is manipulated. Scope determines blast radius, and almost nobody revisits it after the pilot, when a token minted for a two-week test becomes the permission an agent runs on indefinitely.
4. Approve. Reserve human sign-off for actions crossing a defined threshold, rather than routing anything ambiguous to a person.
Most programs begin at step four and work backward, which is why they govern only the activity the security team could already see.
Given 90 days and one initiative, the highest-value move is not an approval workflow but visibility: endpoint and browser-level discovery across the workforce, so the security team knows which agents are running, what they connect to, and what they reach. That baseline is achievable in a quarter at almost any size, and everything else depends on it.
Enterprises cannot approve what they cannot see, govern what they have not discovered, or hold accountable what they cannot attribute to a specific agent, a specific delegated authority, and a specific policy. Approval workflows are the most visible part of AI governance and, for that reason, the part most build first. They should be the last, resting on continuous visibility rather than substituting for it.
