Governing AI Agents Before They Touch Your Operations

A task that's technically complex but cheap to reverse, like drafting a reply to a support ticket, is a low-risk place to let an agent run without a person watching every output. A task that's simple but expensive to undo, like changing a customer's billing amount, is high risk even though the logic behind it is trivial. Grade every candidate task on reversibility and blast radius before you grade it on how good the agent seems at doing it.

This reordering matters because most rollout plans do the opposite: they start with whatever task looks easiest to automate, regardless of what a mistake would cost.

For every task you hand to an agent, decide in advance where a human checks the work: before it happens, after it happens but before anything downstream reacts to it, or only when something looks unusual. Refund approvals and anything touching a live customer contract usually need a check before. Internal data cleanup usually only needs a check after, sampled rather than every time.

Write this decision down next to the task, not just in someone's head. If the agent's output later gets questioned, whether by a customer, an auditor, or your own finance team, you need to be able to show what the intended review point was and whether it happened.

Choose one review point for each task before you automate it:

• Check before the action: use this for refund approvals and anything touching a live customer contract.
• Check after the action but before anything downstream reacts, where an error could spread into other systems.
• Check a sample after the action: use this for internal data cleanup, where mistakes are cheap to catch and undo.
• Check only when something looks unusual, and write the choice down next to the task so it can be shown later.

The record you keep should let someone with no context reconstruct what the agent did, why, and who signed off. That means logging the input, the action taken, and the approval status, not just a success or failure flag. A compliance platform like Vanta or Drata is built for exactly this kind of continuous evidence collection, and it saves you from assembling a paper trail by hand the week before an audit.

Without this, the first time anyone asks a hard question about an agent's decision, the honest answer is often that nobody knows, which is a worse position than having automated nothing at all.

The risk grade you set on day one doesn't hold once you widen what the agent touches. An agent that started by drafting internal summaries and later got access to send those summaries externally has quietly moved risk tiers, even though nobody changed a setting labeled 'risk.' Put a recurring check on the calendar, not just a one-time sign-off, to re-grade any agent whose scope has expanded since the last review.

For example, an agent that begins by summarizing support tickets for the internal team is low risk. If someone later connects it to the outbound email tool so it can send those summaries to customers, the same agent now carries external, hard-to-reverse risk. At that point the review point should shift from a sampled check after the fact to a check before sending, and the owner should record the change and the date. A reasonable rule is to re-grade an agent whenever it gains access to a new system, a new type of data or a new audience, instead of waiting for the next scheduled review.

Somebody needs to own the risk grading itself, not just the agents. In most small and mid-sized companies that falls to whoever already owns process and risk, typically an operations lead: general operations manager pay nationally runs from around $50,090 at the lower end up to roughly $253,390 at the top of the range, a spread wide enough that the title alone tells you little about whether this responsibility already sits with someone qualified to carry it¹.

If nobody currently owns risk decisions of this kind, don't let the first AI agent rollout be the moment you find that out. Assign the owner before you assign the agent its first task.