Who Approved That? How to Set Permissions, Approvals, and Audit Trails for AI Agents

A practical field guide from Automation Ace.

Short answer: before an AI agent acts on your behalf, decide whose identity and accounts it uses, sort its possible actions into permission tiers (read, prepare, internal write, external, financial, irreversible), give it the least access each job needs, require approvals for external, financial, and irreversible actions, and log every action with who it acted for, what it did, why, and who approved it. Review the logs and permissions regularly and revoke what is no longer needed.

Short answer

1. Identity: whose accounts and scopes.
2. Tiers: classify every action.
3. Least privilege: only what each job needs.
4. Approvals: for external, financial, and irreversible actions.
5. Audit trail: every action, reason, and approval.
6. Reviews: monthly, plus on role changes and departures.

Why “who approved that?” matters

Always-on agents such as Dots, Muse, Grok Bot, and Claude Duet can act while you are not watching. When something goes wrong (an email to the wrong client, a duplicate refund, a deleted file) the first questions are who did it, with whose access, and who approved it. If you cannot answer, you cannot fix the problem or prevent the next one. See from chatbots to always-on agents.

Step 1: Decide whose identity the agent uses

• Your own accounts: simplest for personal agents, but the agent can do anything you can. Limit connected apps and scopes.
• A dedicated service account or connection: better for team agents; permissions are explicit and survive staff changes.
• The agent's own identity: some platforms are moving toward agents with their own identities; use it where offered.
• Avoid shared personal logins across agents; if one platform shares sessions between bots, plan permissions with that in mind.

Step 2: Define permission tiers

Step 3: Apply least privilege

• Connect only the apps the job needs, with the narrowest scopes offered.
• Prefer narrow tools (“add a note to a lead”) over broad ones (“edit any record”); see agent permissions in Make.
• Keep local-computer or browser access off unless needed.
• Never paste passwords or API keys into an agent chat; use proper connections or a password manager; see credential sharing.

Step 4: Design approvals

Workflow tools add approvals too; see Human in the Loop, human approval steps, and approval workflow automation.

Step 5: Keep an audit trail

Use the agent platform's activity history where available, and keep your own log for actions that matter, especially when agents act through your automations:

Audit log entry for every agent action

timestamp            2026-11-06T14:32:10Z
agent                "Sales Assistant" (version 7)
acting_for           jane@company.com
identity_used        connection: hubspot-sales-service
tier                 3 (external)
action               send_email
target               lead crm_123 (pat@prospect.com)
inputs_ref           draft_456
reason               "Lead asked for pricing; sent standard pricing reply"
approval             approved_by: jane@company.com at 14:31:58 (Slack)
result               success, message_id abc123
reversible           no

Store logs somewhere the agent cannot edit. See how to find which automation changed a record and monitoring agents.

Step 6: Review, revoke, and improve

• Monthly: review connected apps, scopes, and a sample of actions.
• On role changes: update what agents can do for that person.
• On departures: revoke connections and transfer agent ownership; see what happens when someone leaves.
• After incidents: trace the log, fix the permission or approval gap, and document it.

What today's agents offer

Based on launch descriptions at the time of writing: Muse is described as asking for approval before sending emails or making purchases and showing an audit trail; Claude Duet as checking with you before acting and keeping passwords and sign-in tokens away from the agent; Dots as using read-only access for background research, with local computer access as a separate, approved connection; and Grok Bot as bots that share a cloud computer and app logins, which makes per-bot permission planning important. Check each product's current controls; see the four agents compared.

Checklist

• Identity and accounts chosen per agent.
• Every action mapped to a tier.
• Least-privilege connections and narrow tools.
• Approvals for tiers 3 to 5, with named approvers and timeouts.
• Audit log with actor, identity, action, reason, approval, and result.
• Monthly reviews and immediate revocation on departures.

Deciding what to hand over in the first place? See what to delegate to an AI agent.

Frequently asked questions

How do I set permissions for an AI agent?

Decide whose identity and accounts the agent uses, classify its possible actions into tiers such as read, prepare, internal write, external, financial, and irreversible, give it the least access each job needs, and prefer narrow tools over broad access.

Which AI agent actions need approval?

External actions such as sending messages or posting publicly until the agent is proven, financial actions such as payments and refunds every time, and irreversible or access-changing actions such as deletions and permission changes, which may be best not delegated at all.

What should an AI agent audit trail include?

The time, the agent and its version, who it acted for, which identity or connection it used, the permission tier, the action, the target, the reason, who approved it and when, the result, and whether it is reversible.

Should an AI agent use my personal accounts?

For personal agents it is often simplest, but the agent can then do anything you can, so limit connected apps and scopes. For team agents, dedicated service accounts or agent identities make permissions explicit and survive staff changes.

How often should I review AI agent permissions?

Review connected apps, scopes, and a sample of actions monthly, update permissions on role changes, revoke access immediately when someone leaves, and close permission or approval gaps after any incident.