AI agent permissions and approvals: how to let agents act safely

Contents

1. Why the controls matter
2. The three controls
3. How the platforms implement approval
4. Where the log lives
5. A permissions plan for a first agent
6. Questions buyers ask
7. Sources

Letting an agent act is a delegation, and delegation in a company usually comes with limits: a spending authority, a list of who signs what, a record of what was done. The same three controls apply to AI agents. What varies between platforms is how precisely each can be set, and whether it holds in every place the agent works.

Why the controls matter

Security bodies and incident data point the same way. OWASP lists excessive agency among the top risks for AI applications and traces it to three causes: excessive functionality, excessive permissions and excessive autonomy. Its recommended mitigations are least privilege, complete mediation and human approval for high-impact actions⁠1LLM06:2025 Excessive AgencyOWASP Gen AI Security Project. IBM's 2025 study found that 13% of organisations reported a breach of an AI model or application, and that 97% of those lacked proper AI access controls⁠2IBM report: 13% of organizations reported breaches of AI models or applications, 97% of which reported lacking proper AI access controlsIBM Newsroom · 30 Jul 2025. NIST's AI Risk Management Framework organises the same work into four functions: govern, map, measure and manage⁠3AI Risk Management FrameworkNIST.

The three controls

1. Scope: what the agent can reach. Which records and which tools. The narrowest useful scope is the safest. Some platforms make this hard: Lindy notes that connecting a tool enables all of its actions at once, and that one guardrail covers every account under an integration⁠4IntegrationsLindy Docs.

2. Approval: what waits for a person. Expressed as a rule the company sets, not a judgement the agent makes. The strongest rules are written in business terms, such as a purchase order over $15,000 or a credit over $500, which is how OpenLazarus describes its per-teammate limits⁠5AI for wholesale and distribution: orders, stock, suppliersOpenLazarus.

3. Record: what is logged, and where. Every action, against the record it touched, readable by the people accountable for it.

How the platforms implement approval

Two details deserve attention. Lindy's guardrails do not apply in its web app, Slack direct messages or text messages⁠4IntegrationsLindy Docs, so a request made in those channels is not held for approval. And Copilot Studio's multistage approvals, though the most elaborate, are still a preview feature⁠12Multistage and AI approvals in agent flowsMicrosoft Learn · 15 Oct 2026; its strength lies in tenant-wide governance (data policies, Purview audit logs, Entra identities for agents) rather than in per-action approval⁠13Security and governance in Copilot StudioMicrosoft Learn · 24 Sep 2026.

Where the log lives

An approval is only as useful as the record it leaves. Audit logs are an Enterprise feature at Relevance AI, Lindy, n8n and Dify⁠14151617PricingRelevance AI DocsPricingLindyn8n plans and pricingn8nDify pricingDify, start on the Team plan at Zapier with six months of retention⁠18Zapier pricingZapier, and run through Microsoft Purview in Copilot Studio⁠13Security and governance in Copilot StudioMicrosoft Learn · 24 Sep 2026. Where an agent acts in another company's app, the agent platform's log and the app's own history are separate, and reconciling them is the reviewer's job. OpenLazarus logs every teammate action in the same system that holds the records⁠5AI for wholesale and distribution: orders, stock, suppliersOpenLazarus.

A permissions plan for a first agent

1. Write the job description: the records the agent may read, the records it may change and the tools it may use.
2. Set approval on every write and every external message for the first two to four weeks.
3. Define the thresholds that will keep approval permanently: money, terms, dates promised to customers, anything above a set value.
4. Test every channel the agent works in, and confirm the approval rule applies in each.
5. Name the approvers and a backup, and decide what happens if no one answers. Dify's default, for example, is a three-day timeout followed by a separate branch⁠11Human Input nodeDify Docs.
6. Review the log weekly, then relax rules only for actions with a clean record.

The end state looks like a well-run finance team: the agent acts freely below a limit, a named person approves above it, and the log answers the question "who did this, and on whose authority" for every record.

Questions buyers ask

Sources

1. LLM06:2025 Excessive Agency. OWASP Gen AI Security Project. Accessed 8 Nov 2026.
2. IBM report: 13% of organizations reported breaches of AI models or applications, 97% of which reported lacking proper AI access controls. IBM Newsroom, 30 Jul 2025. Accessed 8 Nov 2026.
3. AI Risk Management Framework. NIST. Accessed 8 Nov 2026.
4. Integrations. Lindy Docs. Accessed 8 Nov 2026.
5. AI for wholesale and distribution: orders, stock, suppliers. OpenLazarus. Accessed 8 Nov 2026.
6. Questions about OpenLazarus (FAQ). OpenLazarus. Accessed 8 Nov 2026.
7. Approvals and escalations. Relevance AI Docs. Accessed 8 Nov 2026.
8. Human-in-the-loop for tools. n8n Docs. Accessed 8 Nov 2026.
9. Zapier Agents is now AI by Zapier. Zapier. Accessed 8 Nov 2026.
10. Add approval steps to your agent’s instructions. Zapier Help Center, 1 Oct 2026. Accessed 8 Nov 2026.
11. Human Input node. Dify Docs. Accessed 8 Nov 2026.
12. Multistage and AI approvals in agent flows. Microsoft Learn, 15 Oct 2026. Accessed 8 Nov 2026.
13. Security and governance in Copilot Studio. Microsoft Learn, 24 Sep 2026. Accessed 8 Nov 2026.
14. Pricing. Relevance AI Docs. Accessed 8 Nov 2026.
15. Pricing. Lindy. Accessed 8 Nov 2026.
16. n8n plans and pricing. n8n. Accessed 8 Nov 2026.
17. Dify pricing. Dify. Accessed 8 Nov 2026.
18. Zapier pricing. Zapier. Accessed 8 Nov 2026.

Updated 8 Nov 2026: First published.

Further reading

• Buyer's guide · Updated quarterlyThe best no-code AI agent builders for company work in 2026An analysis of seven platforms for building AI agents without code, judged on the controls a company needs before an agent changes a real order, invoice or customer record.
• Guide · CapabilitiesWhat AI agents can do for a business today, and what they cannotAgents now answer mail and calls, key orders, chase invoices and prepare reports. They still fail about one task in three on hard benchmarks, which decides where they should start.
• Guide · CostWhat no-code AI agents cost: credits, actions, executions and the monthly billEvery platform meters agent work in its own unit. Converting those units into the cost of one task is the only way to compare them, and the only way to avoid the cost overruns Gartner expects to end many projects.