AI at Work

When AI Can Act for You, Decide What Needs Your Approval

By Priya Lindqvist / October 20, 2026 / Updated November 8, 2026

Woman looking toward the camera at a desk with a laptop

Quick answer: Let an AI agent read, search and draft all it likes, but make it stop and ask before anything that sends, spends, deletes, publishes or shares. Published guidance from OWASP, NIST, OpenAI and Anthropic points the same way: give the agent the narrowest access that gets the job done, and keep a person in the loop for high-impact actions. The permission screen decides what an agent can do. Your instructions decide what it should do, and only one of those is enforced by software.

Key takeaways

OWASP names three ingredients of “excessive agency”: too many tools, too many permissions and too much autonomy.
Approval prompts are one safety layer, not a guarantee. OpenAI’s guidance says agents can still make mistakes or be manipulated even with safeguards.
Anthropic’s documentation says permission rules are enforced by the app, not the model, so a polite instruction in your prompt is not a lock.
Before you connect an account, decide what the agent may do alone, what needs your yes, and what it never touches.

Reading is not acting

An assistant that drafts a reply to your landlord gives you a block of text. You read it, wince at the third sentence and fix it. An agent that sends the reply has changed something outside the chat window, and “undo send” is a feature, not a law of nature.

Calendars make the point nicely. Reading your calendar, editing an event and inviting other people are three separate actions, yet a permission screen may bundle them under one friendly button. Read what the connection really allows.

NIST’s Center for AI Standards and Innovation describes agent systems as a generative AI model plus software that gives it tools to take actions in real-world systems. That “tools” part is the whole story. A model with no tools can only talk. A model with your inbox and payment page can do things.

One honesty note: this is a read of published documentation and standards. We did not test any of these products, and nothing here describes how a specific tool behaves on your account.

What the published guidance says

Four sources, one theme, as of November 2026.

Source	What it says	What it means for you
OWASP Gen AI Security Project, “LLM06:2025 Excessive Agency”	Harm happens when a system has unneeded tools, more access than the job needs, or can take high-impact actions unchecked. Fixes include least-privilege credentials, human approval for actions like sending messages or deleting data, and enforcing authorization outside the model.	Prefer connections you can narrow to read-only, one folder or one calendar.
NIST CAISI, “Request for Information Regarding Security Considerations for Artificial Intelligence Agents” (comments closed March 9, 2026)	Warns agent systems may be susceptible to hijacking and other exploits, mentions least privilege and zero trust, and asks about approvals for consequential actions and ways to roll back unwanted actions.	A call for input, not finished guidance. It shows what experts worry about.
OpenAI, “Safety in building agents”	Keep tool approvals on for MCP tools so users can review every operation, reads and writes included. A model may send a connected tool more data than you expected, and untrusted text can override an agent’s instructions.	If a product offers per-action confirmation, keep it on.
Anthropic, Claude Code “Configure permissions”	Read-only actions generally run without asking, while shell commands, file edits, web fetches and searches ask by default. Rules are checked in the order deny, ask, allow. A bypass mode skips prompts and is meant only for isolated environments.	Defaults differ between products and modes. Learn which mode you are in.

The OWASP page we read is the 2025 edition, so check for a newer one.

A simple approval ladder

No source above prescribes this scheme, so treat it as our rule of thumb: the more people, money or permanence involved, the more your explicit yes matters.

Tier	Examples	Suggested default
1. Look	Read a calendar, search files, summarize a page	Usually fine, but limit which accounts and folders it sees
2. Draft	Write an email draft, propose a meeting time	Fine. You review before anything leaves the chat
3. Change your own stuff	Rename files, edit your own calendar entry	Ask each time while learning, then check the result in the app
4. Affect others or spend money	Send an email, invite people, post publicly, place an order	Always approve one by one
5. Hard to undo	Delete, overwrite, share widely, change account security	Read exactly what will happen first, or do it yourself

A good instruction names the boundary out loud: “Find three times next week that work for both calendars, then show me the invite before you send it.” “Handle my scheduling” is an invitation to find out what tier 4 feels like.

A checklist before you connect anything

Read the permission screen line by line and pick the narrowest option that works.
Start with a low-stakes account, such as a spare calendar.
Turn on confirmation prompts for anything that sends, spends, deletes or publishes, and leave them on.
Put the boundary in the request: what to do, what to show you first, what not to touch.
Treat outside content (web pages, forwarded emails, shared documents) as potentially hostile, since text an agent reads can contain instructions aimed at the agent.
After the agent reports success, check the calendar, file or message in the real service.
Skip bypass or “approve everything” modes outside an isolated test setup.

Where approvals fall short, and what regulators watch

OpenAI calls its built-in guardrails a useful first layer that is not foolproof, and says its structural fixes reduce prompt-injection risk without removing it. OWASP adds that downstream systems should check permissions themselves rather than trusting the model to police itself. Our own observation, not from those sources: if every click is a prompt, people approve on autopilot, so a few meaningful gates beat a wall of them.

Regulators are paying attention too. On October 8, 2026, the UK Information Commissioner’s Office opened a call for evidence on agentic AI. According to the write-ups we could open, it covers how existing UK data protection law applies to AI agents, across six themes including data security, transparency and accountability. Responses were reported to close on November 20, 2026, and will inform future guidance. The document itself is not binding. The ICO’s own page refused our request, so these details come from two secondary sources, and we dropped an earlier claim about enquiries into testing incidents because we could not verify it.

Frequently asked questions

Is an AI agent just a chatbot with extra steps?

Not quite. A chatbot answers. An agent, as NIST describes it, uses tools to take actions affecting real-world systems. The extra steps are the point, and also where the risk comes from.

Should I approve every single action?

Not necessarily. Tired people click yes. A tiered approach saves your attention for actions that affect other people, cost money or cannot be undone.

What is prompt injection, and do approvals stop it?

OpenAI describes it as untrusted text or data that tries to override an agent’s instructions, which can lead to data leaving through later tool calls. An approval step can catch an odd action if you read it carefully, but risk is reduced, not eliminated.

Does the ICO’s call for evidence restrict AI agents in the UK?

As reported, no. It asks for evidence on how existing data protection law applies, and the document is not binding. It is also UK-specific.

Before you decide

Write down three lists before you connect an account: what the agent may do alone, what it must ask about, and what it must never touch. It takes five minutes and turns a vague “sure, go ahead” into a boundary you can check.

Keep the first task small. Let the agent prove itself on a tier 1 or 2 job, verify the result in the real app, and widen permissions one notch at a time. If a tool will not let you narrow access or confirm risky actions, think twice. Products change quickly, so recheck settings and sources.