Scope and permission templates
One scope file per agent: allowed tools, data, limits, approvers, and a review date.
GenAI & Agents
AI Agent Controls
Scope, permissions, logging, and approvals for AI agents.
The same controls we apply to the AI agents on our own team. Each agent gets a written scope, minimum necessary permissions, a log of every action, and human approval for high-impact actions. Agents cannot change their own permissions. Any agent can be paused or switched off at once.
GIST stepTrust
Download the PDF What you get
AI agents your security team can review and approve.
Free download · PDF · 10 pages
Get the AI Agent Controls overview
The problem it solves, what is included, how it works, the technical components, and how we adapt it with you.
Your download has started.
We also emailed the link to . It stays valid for 7 days.
Download didn't start? Get the PDF
Want to see how it would fit your data? Talk to us.
The problem
Agents take real actions. Security needs to see the limits.
An agent that can send email, update records, or queue payments needs the same controls as a new employee with system access. Most agent projects add those controls late, if at all.
What this accelerator does
AI Agent Controls give each agent a written scope, check every action against it, and let you switch any agent off at once. They are the controls we apply to the agents on our own team.
What's included
A written scope, enforced on every action.
Four parts, each adapted to your data, platforms, and controls. What we adapt for you is yours to keep.
Action logging and audit trail
A hash-chained log of every action, block, and approval, copied to Azure Monitor or your SIEM.
Human approval
High-impact actions wait for a named approver who is not the agent's owner.
Switch-off and limits
Stop one agent or all agents at once, with action and spending limits per run and per day.
How it works
Every tool call passes five checks.
Switched off?
A stop file for this agent or all agents, an environment switch, or a paused scope.
Prohibited?
A baseline list no scope can remove, such as changing its own permissions or disabling logging.
In scope?
The tool must be listed and every data resource allowed. Denied always wins.
Within limits?
Actions and cost, per run and per day.
Approved?
High-risk tools wait for a listed approver who is not the owner. No answer counts as a denial.
Logged either way
Success, failure, cost, and duration are recorded. Blocks go back to the model to explain.
Technical detail
Under the hood.
Vendor-neutral Python and configuration, Azure first, with tests included from the start.
- Guard
- Wraps the tool functions an agent calls, so it works with any framework
- Scope files
- Reviewed like code and stored where the agent cannot edit them
- Approvals
- A file queue by default, or routed to Teams, ServiceNow, Jira, or email
- Audit log
- JSON lines with a hash chain that shows edits, removals, and reordering
- Switch-off
- A stop takes effect on the agent's next tool call
- Operator CLI
- Pending, approve, deny, stop, resume, verify, and report
Proof in the package
Worked example: an accounts-payable agent that triages invoices.
The agent checks invoices against purchase orders. The demo walks through every control.
What happens
- Mismatched invoices are flagged; matched ones wait for payment approval
- Reading supplier bank details is blocked
- Releasing a payment is prohibited
- Changing its own permissions is refused
- Approval from someone off the list does not count
- After switch-off, every call is blocked
Result
Every event is in the audit log, and the hash chain verifies it is intact.
How we run it with you
Adapted in the first cycles, handed over at the end.
- 01
Design the scope
The permission matrix sets tools, data, limits, and approvers for each agent.
- 02
Wrap the tools
The guard goes around every tool the agent calls, under its own managed identity.
- 03
Name approvers
For every high-risk tool, none of them the agent's owner, in your approval system.
- 04
Test the switch-off
Run the procedure, fill in escalation contacts, and set a review date.
You keep the scope files, the guard, the audit trail, and the switch-off and escalation runbooks.
Where it fits
Platforms, related accelerators, and limits.
We state the limits up front, and we recommend tools based on fit. We do not resell platforms.
Works with
- LangChain, Semantic Kernel, AutoGen, the OpenAI and Anthropic SDKs, or your own code
- Azure managed identities and Azure Monitor
- Teams, ServiceNow, Jira, or email for approvals
Pairs with
- The AI Governance Starter records each agent and checks its scope file
- Enforces governance controls AIG-06, 07, 08, and 10
- GenAI Evaluation Tests check behavior before release
Assumptions and limits
- It controls the tools you wrap, so we pair it with platform permissions
- Cost limits use the costs you connect from your model provider
- Agents on several machines need shared state storage
Take the overview with you.
Get the 10-page PDF to share with your team, or tell us the decision you want to improve and we will tell you whether the AI Agent Controls fits.