Permission before action: how the workflow works

Is the agent allowed to perform this operation

An agent working across several systems proposes actions: reading a document, changing a customer record, a correction in the finance system. Each request carries an identity, a data class and whether the action can be undone. A separate permission check decides before the call: a forbidden action stops before the system, and a high-risk action waits for a second approval. Each decision records the rule, its version, who performed the action and the approval required.

This matters with content from outside. OWASP describes prompt injection as the number one risk for applications built on language models: an instruction hidden in a document or an email can push the model to try a forbidden operation. The policy layer works outside the model, so such an attempt stops at the rule.

What a policy layer for AI agents costs and when it pays back

The count covers the work around a case: searching, reading, writing and passing it on. What stays is the time to check the output, 20% of today's work in the scenario. Before we quote, we measure both times on 20 to 100 cases your team has already handled, in a €0 test that takes 5 working days.

The scenario compares today's manual approval of every agent action with a policy layer after which a person approves only high-risk actions. The share of those actions, 20% of today's work, is an assumption to check against the client's rules.

When permissions in the systems themselves are enough

If the agent works in one system and its account has narrow permissions set by the administrator, a separate policy layer may be unnecessary. The layer makes sense when the agent works across several systems and the same operation is allowed for one department and forbidden for another, or when some actions need a second approval depending on the amount or the data class. List the allowed operations and the owners of the rules, start with one tool and test the allowed and forbidden combinations of identity and resource. The risk of instructions hidden in documents is covered in the article on prompt injection in AI agents.

Where to start

To prepare: a list of the operations the agent should perform, the owners of the rules in each system and examples of allowed and forbidden requests. The people responsible for the systems approve the roles, the exceptions and the actions that need a second approval. We build this kind of rollout as part of AI agents. For the free process review, a description of one case from recent weeks and the tools it went through is enough. You do not need to send confidential documents, and you get a written plan within 2 working days.