More businesses want AI to read email, look up customer information, prepare quotes, update spreadsheets or even send messages and change business systems. That can reduce repetitive work, but it also changes the risk: an incorrect answer may be executed immediately.
Whether AI can produce correct content and whether it should execute a high-impact action are separate questions. A business needs to decide which actions can run automatically, which need approval, and how permissions, logs and rollback fit into the workflow.
The risk changes when AI moves from recommending to acting
A conventional assistant returns text for a person to read, assess and copy. Once connected to email, CRM, cloud storage, databases or finance workflows, AI can call tools and turn its output into an external message, a write, a deletion or a permission change.
OWASP's LLM06:2025, “Excessive Agency,” identifies excessive functionality, permissions and autonomy as contributing causes. The control is not to abandon automation; separate generated content from execution and decide, according to impact and reversibility, whether an action can run automatically, needs sampling or needs approval immediately before the consequential step.
Four high-impact action types should require approval by default
- External communications. Customer email, bulk notices, platform submissions and external replies speak for the business. Show the content, recipient and attachments before sending.
- Changing or deleting business data. For bulk updates to customers, quotes, inventory, files or work orders, show the before-and-after differences, scope and handling.
- Making financial, contractual or approval commitments. AI can extract fields and flag exceptions, but a responsible person should confirm formal prices, payments, contracts and approval decisions.
- Changing permissions or access scope. Account creation, privilege elevation, file sharing and external access should use least privilege and retain an approval and revocation path.
Grant permissions for the task, not for possible future use
OWASP recommends giving an agent only the extensions, functions and permissions needed for its task. If it summarizes email, it should not have send or delete rights. If it checks inventory, it should not change prices. If it drafts content, it should not have publishing permission.
A business should also avoid sharing one high-privilege service account across everyone. Link the initiator and business role to the permissions on the target system, and limit accessible records, recipients, environments, amounts and action rates. Reject actions outside scope or send them for approval. Recheck tool inventories and remove unneeded capabilities when workflows, people or interfaces change.
Make approval understandable to the responsible person
NIST AI RMF calls for defining human and AI roles, oversight and accountability, and recording system boundaries and how outputs are used. Its Playbook also recommends preserving history and audit logs, human overrides, escalation and continue-or-stop decisions.
An approval screen should at least show who initiated the action, what it will do, the affected objects, its basis, before-and-after differences and how failure is handled. Low-impact, reversible actions with clear rules can have simpler review after validation. High-impact, irreversible actions or external commitments should keep stronger approval.
Design logs, pause and rollback together
CISA's logging guidance for small and midsize businesses emphasizes recording who accessed what, when, and which activities occurred. AI automation logs should connect the initiator, input source, tools called, target objects, approver, outcome and reason for failure.
Prepare a pause control and a recovery path too. It should stop new and queued actions, disable or revoke execution access, preserve evidence and have a named owner. Prevent retries from repeating messages or changes, and test failure handling and rollback. When something is wrong, identify what already ran and reverse or manually correct the impact according to operating rules. Not every action can be rolled back, which is another reason to control high-impact steps before execution.
Four preparations to complete first
- List the actions. Write down each read, write, send, delete, approval and permission change.
- Classify by impact. Automate low-impact reversible work, sample-check or conditionally approve medium-impact actions, and confirm high-impact actions individually.
- Restrict accounts and tools. Give each workflow only the functions it needs, and disable legacy plugins and high-privilege service accounts that are no longer required.
- Rehearse on a small scope. Use redacted or test data to verify approval, logging, pause and recovery before expanding the audience or workload.
The goal of business automation is not to remove people from every step. Let machines prepare repetitive work, while responsible people decide at the points that affect customers, money, data and permissions.
If you need to review AI actions and approval boundaries in quoting, contracts, repair or after-sales workflows, contact Yuqi Intelligent to start with existing templates, permissions and exception handling.