Why this matters now
An AI assistant suggests. An AI agent can access data, choose tools and take actions. That makes agents useful for recurring work such as chasing invoices, preparing onboarding tasks or monitoring renewals, but it also increases the impact of a bad instruction, exposed credential or unexpected decision.
The National Cyber Security Centre recommends controlling autonomy with safeguards, sandboxing, active oversight, observability and an emergency shutdown. OWASP describes "excessive agency" as the risk created when an agent has more functionality, permissions or autonomy than its task requires.
For a 20-50 person company, the answer is not a heavyweight governance programme. It is a short set of controls that makes every agent visible, accountable and stoppable.
ELI's five-gate rule
Before an agent moves from experiment to live workflow, it should pass five gates: Owner, Access, Approval, Budget and Exit.
10 controls to put in place
1. Give every agent a named owner
One person should be accountable for the workflow, its permissions, its cost and its outcomes. Add a backup owner so the agent does not become untouchable when someone is away or leaves the company.
2. Create a separate identity for the agent
Do not let an agent run through a founder's personal login. Use a dedicated account or service identity so its actions can be attributed, reviewed and revoked without disrupting a human user.
3. Grant the minimum access required
A renewal-monitoring agent may need to read contracts and billing emails, but it does not need permission to delete messages or approve payments. Start read-only, scope access to the smallest dataset and add capabilities only when the workflow proves it needs them.
4. Put human approval before consequential actions
Require review before an agent sends external messages, changes permissions, deletes records, signs contracts, commits code or moves money. The approval should show the proposed action and the information used to reach it.
5. Set spending and activity limits
Give each agent a daily or monthly budget, a maximum number of actions and alerts for unusual spikes. The goal is to contain both runaway token usage and repeated actions across connected tools.
6. Log every action, not just the final answer
Record who triggered the agent, which systems it accessed, what action it proposed, what it executed and whether a human approved it. Logs should be searchable and tied to the agent's own identity.
7. Test the failure paths
Test missing data, conflicting instructions, malicious content, unavailable APIs, duplicate requests and partial failures. A successful demo proves the happy path; a production-ready agent needs a predictable response when the happy path disappears.
8. Start in a sandbox
Let the agent work on test records, draft outputs or copied data before connecting it to live systems. Then run a limited pilot with a small group, low limits and reversible actions.
9. Define the shutdown procedure
Document how to pause the workflow, revoke credentials, block external actions and identify everything the agent changed. Test the shutdown before launch so it is a real control rather than a sentence in a policy.
10. Review the agent after every material change
Recheck access, approvals and expected behaviour when the model, prompt, tools, integrations or business process changes. Also review usage and cost on a regular cadence, even when nothing appears to be wrong.
A 30-minute launch review for a small company
- Write the agent's single job in one sentence.
- List every system, dataset and action it can access.
- Mark the actions that require human approval.
- Set a budget, action limit and anomaly alert.
- Name the person who can pause it and revoke access.
If the team cannot answer all five points, keep the agent in draft mode. This lightweight review is enough to prevent most early-stage mistakes without creating a procurement process that slows the company down.
What the five-gate rule changes
Most teams review an agent as a piece of software: what it does, whether it works and how much it costs. ELI's view is that an agent should also be managed as an active operator. It needs ownership, permissions, a budget, an approval boundary and an exit path.
That operating record should sit beside the company's software subscriptions, seats and recurring workflows. When those records live together, founders and operations leads can see which tools and agents exist, who owns them, what they can reach and what they cost.
Frequently asked questions
What is an AI agent security checklist?
It is a pre-launch list of controls covering ownership, access, approvals, spending, monitoring, testing and shutdown. Its purpose is to keep an agent's actions within a defined business boundary.
Should a startup allow AI agents to act without approval?
Only for low-risk, reversible and well-tested actions. Payments, external communications, deletions, access changes and legal commitments should normally require human approval.
What permissions should an AI agent have?
Only the permissions needed for its current task, ideally through a dedicated identity and time-limited credentials. Begin with read-only access whenever possible.
How should we monitor an AI agent?
Track triggers, tool calls, records accessed, actions proposed, actions completed, approvals, errors and spend. Alert on unusual volume, cost, destinations or permission use.
How often should AI agent access be reviewed?
Review it after material changes and on a regular cadence. Monthly is sensible for high-impact agents; quarterly may be enough for narrow, low-risk workflows.
Manage agents like operators, not subscriptions
ELI gives growing companies one operating layer for software, subscriptions, seats and AI agents. Discover what is running, assign owners and budgets, monitor spend and keep recurring back-office work under control. Start with ELI.
