AI agent approval policy: what can an agent do without asking?

An AI agent approval policy sorts every action into three groups. The agent acts on its own when an action is low-risk, easy to undo and inside limits you wrote down, such as answering questions, reading records, drafting and booking open slots. It waits for a named person before it moves money above a limit, changes a customer's terms or sends data outside. Some actions it never takes.

Security standards treat this as a basic control. OWASP lists "excessive autonomy" as one root cause of what it calls excessive agency, and its advice is to "require a human to approve high-impact actions before they are taken" (OWASP).

How do you decide which actions need approval?

Ask three questions about each action the agent can take:

1. Can it be undone? A draft or a calendar hold can be reversed in seconds. A sent refund, a deleted record or an email to a customer cannot.
2. What does a mistake cost? Put a dollar figure or a customer count on the worst likely error. That figure becomes your threshold.
3. Who sees the result? Actions that stay inside your team are safer than actions that reach customers, suppliers or regulators.

If the action is reversible, cheap and internal, the agent can do it alone. If it fails one test, it needs approval. If it is irreversible, expensive and external at once, put it on the never list, or keep it as a task the agent prepares and a person carries out.

What does an AI agent approval policy look like?

Here is a starting policy you can copy. The limits and roles are examples; set your own.

Action	On its own	Needs approval	Never
Answer questions	From your approved sources	New policy or pricing questions	Guess when no source exists
Bookings	Open slots, standard services	Overbooking, after-hours jobs (ops lead)	Cancel another customer
Refunds	Up to $50	Over $50 (finance lead)	Over $500, or to a new account
Discounts	Published offers	Up to 10% (sales manager)	Change list prices
Records	Add notes, update status	Merge or edit contact details	Delete
Data sharing	The customer's own records, to them	Exports (data owner)	Send data to unknown recipients
Access	Request it	Grant it (IT)	Grant itself more access

The table only works with two habits. Every approval names a role and a backup, so requests never sit in a shared inbox. And the agent stays within the access of the person or team it works for.

What changed recently?

The large platforms are moving these limits out of the model and into the system around it. On October 19, Microsoft described agents with their own identities and permissions scoped to the task. These permissions can shrink when an agent drifts from its job, and higher-impact actions can require verified human approval (Help Net Security). Its security chief wrote that frontier models "cannot be trusted," because they were trained to finish tasks, not to follow "organizational norms or judgment" (TechCrunch).

ServiceNow announced AI Passport on October 15: a signed credential that agents check at runtime to confirm what they are allowed to do, expected in Q4 2026 (ServiceNow). Kognitos launched finance agents on October 21 whose limits are set action by action, and a run pauses to ask a person when a case falls outside its procedure (Kognitos).

How do you keep approvals from becoming a rubber stamp?

People who approve a hundred requests a day stop reading them, so keep the queue short. A good request should:

• show what the agent wants to do, why, and which rule sent it for approval;
• let the approver change the amount instead of only accepting or rejecting it.

Then read the log once a month. If an action was approved every time without a change, move it into the on-its-own column.

Frequently asked questions

Can an AI agent approve its own request?

No. The agent can ask for more access or a larger limit, but a person or a separate policy check outside the agent has to grant it. Otherwise the limit is only a suggestion.

What happens if nobody approves in time?

The action waits. The agent tells the customer when to expect an answer, reminds the approver, and passes the request to the backup after a set time. It does not go ahead by default.

Next steps

Write your AI agent approval policy before the agent goes live, and start stricter than feels necessary. Loosening a limit after a month of clean logs is easy. Undoing a wrong refund to an angry customer is harder. Aurora works this way: you choose what it does on its own, what needs approval and what it never does. When a request crosses a limit, the right person gets it and decides, and each action is logged with the rule that applied and who approved it.

See how Aurora handles rules and approvals, read when an AI agent should hand off to a human and how an AI customer service agent solves a request, or learn what MCP connects on the way to your systems.