Give every agent an identity
An agent should be identifiable in the same way as a service account or contractor. Its activity must not disappear inside a shared human login.
AI governance for real work
AI agents need an identity. Here is how to govern them.
As AI moves from answering questions to taking action, every organisation needs a clearer way to define access, ownership and accountability.
The goal is not to slow useful innovation. It is to make sure each agent has a purpose, a bounded identity, the right amount of access and a person who remains responsible for the outcome.
See the practical frameworkWhy this matters now
An AI assistant can become an actor in your business faster than you expect.
Early AI use often begins with a person asking questions or preparing a draft. The next step is more consequential: an agent may search internal sources, classify an enquiry, update a record, prepare a workflow or take a defined action in another system.
That change is useful, but it means an organisation needs to answer familiar technology-governance questions in a new form: who is this agent, what is it allowed to access, who owns its behaviour and how would we know if something went wrong?
“Treat an agent as a new kind of digital colleague: useful, bounded, identifiable and always connected to human accountability.”
The shift
01
Ask
A person asks an AI tool for a draft or answer.
02
Connect
The agent can use selected internal information and systems.
03
Act
The agent can prepare or complete an approved task.
04
Govern
Identity, permissions, logs, ownership and review become essential.
The practical framework
Six controls that make AI agents easier to trust.
The right level of governance depends on the task. These principles help teams avoid both extremes: treating every experiment as high risk, or connecting a powerful agent without enough control.
Start with purpose
Define the task, intended users, source information, expected outcome and person accountable before deciding which tools or permissions to connect.
Use the minimum access needed
Give access to the smallest useful set of systems, information and actions. A broad connection is not a shortcut to a safe pilot.
Keep meaningful actions reviewable
Set clear approval points for commitments, changes, external communication and anything that can materially affect a customer, colleague or system.
Make activity visible
Record who initiated the work, which agent acted, the sources used, the outcome and any exception. Visibility makes review possible.
Review and retire
Agents need an owner, periodic access review, a way to stop them safely and a decision about whether the work still creates value.
Make the distinction clear
A different task calls for a different identity and boundary.
Choose an example to see the questions a team should answer before it broadens an agent's access or autonomy.
Selected pattern
A knowledge agent
Identity
A named service identity with read-only access to a defined knowledge set.
Boundary
It can explain and cite a source. It cannot change the source or make a decision for the user.
Owner
The process or content owner keeps the source material current.
A named owner is not just an escalation address. They decide whether the agent's purpose, access and outcomes remain appropriate as the work changes.
From idea to operating control
A lightweight lifecycle for a useful first agent.
Good governance begins before an agent is released and continues while it is in use. It should be practical enough that teams actually follow it.
01
Define
Describe the outcome, owner, users, information, risk and what the agent must never do.
02
Design
Choose the smallest useful capability, identity, sources, permissions and human approval points.
03
Pilot
Test realistic examples, including weak inputs and exceptions, before widening access or autonomy.
04
Operate
Monitor use, outcomes, changes, costs and incidents. Keep a simple route for users to challenge an answer.
05
Review
Confirm that access remains appropriate, evidence of value exists and the owner still accepts accountability.
The goal is not perfect prediction. It is a clear, reviewable path from useful experiment to accountable operation.
Microsoft identity contextRead Microsoft's Entra Agent ID overview
Platform features can help, but they are not the whole governance model.
Microsoft's Entra Agent ID direction reflects a growing need to identify and manage non-human AI actors. It is an important conversation for organisations using Microsoft AI services, especially where agents use enterprise information or connected systems.
However, technology control is only one part of the answer. The organisation still needs a defined use case, selected information sources, practical approval points, an accountable business owner and a way to review the result. Those questions apply regardless of the platform an agent uses.
Five questions before connecting an agent
1
What business task is the agent improving, and how will we know?
2
Which approved sources and systems does it genuinely need?
3
Which identity, permissions and environments are appropriate?
4
Where must a person approve, challenge or take over?
5
Who reviews access, activity, changes, incidents and value over time?
Further reading
Build capability and governance together.
Start with the wider plan
Use an AI readiness assessment to align opportunity, data, governance and investment decisions.
Read the AI readiness assessmentDefine responsible use
Give staff a practical boundary for using AI safely and consistently.
Read the AI risk policy guidePrepare information
Understand how data loss prevention and classification support safer AI adoption.
Read the AI readiness guideLearn practical skills
Help ordinary business users get more from AI, with verification and safe reuse built in.
Start the practical AI courseExplore the leadership view
Consider the operating, governance and measurable-value questions around everyday AI assistants.
Read the executive overviewBuild a controlled pilot
See how Wavex helps organisations identify, build and improve useful AI work.
Explore AI adoption servicesFrequently asked questions
Questions teams should be able to answer.
Start a governed AI conversation
Find the right boundary for your first useful agent.
Wavex can help you select a practical use case, assess the information and permissions around it, and build a controlled path from pilot to real value.
Discuss your AI agent opportunity
Tell us what work you would like an AI agent to improve. a sector specialist will be in touch. We aim to reply within 1 hour. We aim to reply within 1 hour.