Before connecting an AI agent to approval or other governance workflows, give it a distinct, accountable identity; limit it to the tools, data, and operations required for a defined task; and make an independent system verify authorization and approval for each sensitive action. Also decide what happens when controls are unavailable, what the audit trail must capture, and how you will test the setup before it reaches production.
1. Define the task and the boundaries of access
Start with the specific workflow task, not a general request to “access governance.” Identify the agent’s purpose, the records and people it needs to interact with, and the operations it must perform. Then compare that list with every tool, extension, API, and permission the agent can actually use.
As an Amazon Associate I earn from qualifying purchases.
- List the resources and data classes in scope, such as the particular approval records or workflow stages the task requires.
- Separate reading from creating, changing, approving, deleting, and administering. A read task should not inherit write or delete capabilities by default.
- Remove unused extensions and avoid broad shells, generic APIs, wildcard scopes, or other capabilities that are not necessary for the task.
- Check permissions in downstream services as well as in the agent interface. Restrict access by resource and role wherever the underlying systems support it.
OWASP’s LLM06:2025 guidance on excessive agency describes three distinct problems to check for: unnecessary functionality, excessive downstream permissions, and too much autonomy. Reducing only the number of visible tools is not enough if an available tool still has broad permissions behind it.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →2. Give the agent an identity and an accountable sponsor
Know which named identity appears when the agent acts, and identify the person or system responsible for sponsoring and overseeing it. NIST’s guidance on agent identity recommends unique identifiers, credentials, and entitlements associated with the user or system operating the agent. Avoid shared credentials: they make it harder to attribute actions to the agent and its accountable sponsor.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Confirm how the agent’s identity appears in workflow records and security logs.
- Check that the identity is tied to the appropriate operating user or system rather than being an unowned, broadly privileged account.
- Use delegated authorization in the relevant user’s or system’s security context where practical, with the narrowest workable scope and an appropriate expiry.
- Determine how credentials are issued, limited, rotated, and revoked when the task ends, the sponsor changes, or the agent is no longer needed.
Existing identity protocols and authorization patterns can provide useful foundations. Agent-specific practices are still developing, so confirm that the design fits your organization’s identity and access controls rather than treating an agent label as proof of authorization.
3. Classify actions and put approval where risk warrants it
Classify the actions the agent may take before deciding which need a human decision. Consider the impact and reversibility of each operation, including whether it is financial, administrative, externally visible, or difficult to undo. Routine low-risk steps do not necessarily need a prompt at every turn; high-impact or irreversible actions should have a deliberate approval control.
Bind approval to the proposed action
An approval should authorize a particular action, not grant the agent open-ended permission to act later. Bind it to the actor, tool, target resource, parameters, time, and expiry. If any material part of the proposed operation changes, require validation of the changed request rather than reusing approval for the original one.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use short-lived authorization artifacts where appropriate, and prevent or detect duplicate execution. OWASP’s AI Agent Security Cheat Sheet states: “A valid message signature does not grant permission to perform the requested action.” A verified message or identity is not a substitute for checking that the specific operation is permitted and approved.
Keep approvals meaningful
Too many approval prompts can lead staff to approve reflexively. Reserve interruptions for decisions that meaningfully reduce risk, show enough context for a reviewer to assess the requested action, and make clear what will happen if they approve. Approval should remain a control over the action, not a routine click-through step.
4. Enforce authorization outside the model
Every downstream service or a separate execution or policy layer should check whether the identified actor may perform the exact requested operation, on the exact target, under the applicable approval. The check must also apply when an action originates from an agent or another agent. A model’s own statement that an action is allowed is not an authorization decision.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Verify permissions and approval at the point where the operation is executed, not only when the agent is configured.
- Check that the authorization decision matches the action’s target and parameters; do not let an agent substitute a different resource or operation after approval.
- Ensure that sensitive or irreversible actions are separated from the model’s decision-making and independently validated.
- Test that restrictions still hold when requests contain misleading instructions, attempt privilege escalation, or pass through connected tools.
OWASP’s AI Agent Security Cheat Sheet recommends independent validation for sensitive and irreversible actions, along with authorization checks in downstream systems. These controls matter because an agent’s access may span multiple tools and services, each with its own permissions.
5. Decide how the system behaves when a control fails
For high-impact actions, deny execution if a required risk classification, policy lookup, approval validation, or audit function is unavailable. A timeout, missing response, or logging outage should not silently turn a denied or unverified action into an allowed one.
- Specify which checks are required before each consequential operation.
- Confirm that unavailable or ambiguous policy and approval results block the operation.
- Define a safe recovery path: for example, stop the action and route it for manual review rather than retrying with broader permissions.
- Check whether retries, duplicate submissions, or partial failures could execute an action more than once.
For low-risk operations, an organization may choose different availability behavior, but it should be explicit and consistent with its policy. Do not assume that a workflow’s default error handling is safe for privileged actions.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. Make the audit trail useful without exposing secrets
Operators need enough information to investigate what the agent did and why. For privileged actions, retain records that connect the agent identity and sponsor to the policy decision, approval, tool call, target, and outcome. Protect credentials and sensitive data in logs; auditability should not require storing secrets in plain text.
- Record the identity that initiated the action, the operation and target, the relevant policy decision, and the approval context.
- Capture when the action was requested, approved, and executed, along with its result.
- Restrict access to audit records and protect sensitive values from unnecessary exposure.
- Verify that logging is available when required by policy and that a logging failure blocks high-impact execution if the audit record is mandatory.
NIST SP 800-171 Rev. 3 control 03.01.07 addresses preventing non-privileged users from executing privileged functions and logging privileged-function execution. It applies within that control’s stated scope; it does not automatically impose the same requirement on every organization or governance workflow.
7. Test the allowed paths, the denied paths, and failure cases
Before production, exercise the workflow as it will actually run. Validate not only that permitted tasks succeed, but that excess authority is rejected and failures do not bypass controls. Repeat the relevant tests after material changes to tools, prompts, permissions, policies, or connected systems.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Test permitted reads and writes separately, along with denied writes, deletes, and administrative actions that are outside the task scope.
- Test high-risk actions with valid approval, missing approval, expired approval, and approval for a different actor, target, or parameter set.
- Test whether repeated requests can cause duplicate execution.
- Simulate unavailable policy, approval-validation, risk-classification, and audit services; confirm high-impact actions fail closed.
- Use adversarial inputs, including prompt-injection-like content and privilege-escalation attempts, appropriate to the system’s risk.
- Check whether operators can reconstruct an action from the audit record without exposing credentials or unnecessary sensitive data.
OWASP’s AI Agent Security Cheat Sheet covers least privilege, high-impact approvals, approval binding, replay protection, fail-closed behavior, multi-agent boundaries, and privacy-conscious logging. Treat these as controls to validate in your implementation, not as a guarantee that the agent is safe.
8. Use a pre-grant decision checklist
- Identity: Is there a distinct agent identity, and is a sponsor accountable for it?
- Scope: Are the task, resources, data classes, tools, and operations explicitly limited?
- Delegation: Are credentials appropriately scoped, time-limited, and revocable?
- Separation: Are read, write, delete, and administrative capabilities distinguishable and granted only when needed?
- Approval: Are high-impact actions subject to approval bound to the exact actor, tool, resource, parameters, time, and expiry?
- Enforcement: Does an independent downstream control verify authorization and approval for every consequential request?
- Failure behavior: Do required checks fail closed when unavailable?
- Audit: Can operators inspect identity, policy decision, approval, call, target, and outcome without logging secrets?
- Operations: Are prompts meaningful enough to avoid habitual approvals, and are denied paths and failure modes tested?
What current guidance does—and does not—establish
NIST’s NCCoE project hub describes ongoing work toward implementation-oriented resources on agent identity and authorization, including an intended SP 1800 series practice guide with example implementations and architectures. The hub reports more than 600 responses to its February 2026 concept paper; that is a response count for the project, not a measure of adoption or security effectiveness. Check the project’s current materials for the status of any deliverables.
This checklist is security guidance, not a legal determination or a guarantee of safety. Applicable organizational policies and sector requirements vary, and OWASP guidance can be updated. Apply the controls that fit the workflow’s risk and your organization’s requirements.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
