AI Agent Control: Human-Approved Actions on Your Own Tenant
Your assistant reads chat, tickets, wiki and CRM and wants to act. The question your security review will ask is not how good the model is. It is who approved the write, what the approver saw, and how you take it back. This page is the operating model I build, running on a company's own EU tenant, and the fixed-price review that gets your agents there.
- 0Writes without a human tapBy construction, on every door incl. MCP
- 1Review per signalThe same message never asks twice
- 6Systems under one gateChat, tickets, wiki, CRM, mailbox, meetings
- 0Service accountsEvery read and write as the signed-in person
What breaks first is not the model
In the threads where practitioners compare notes on agents in production, r/AI_Agents, Indie Hackers, the LangGraph, pydantic-ai and MCP issue trackers, one reading repeats: the failures that hurt did not come from the model failing to reason. They came from the plumbing around it. Five of them, and the control that answers each.
| Failure | What it looks like | The control |
|---|---|---|
| The confidently wrong match | A company is renamed, a subsidiary shares contacts, someone uses the product name as the customer name. Every field validates, and the update lands on the wrong account at full confidence. There is no 429 and no dead-letter queue for that. It goes quietly to the wrong team. | The canonical customer is resolved before the write path, never after retrieval. The approval card names the resolved customer and quotes the passage, so the person approving sees what was matched, not only what will be written. How the matching holds |
| The email that is already gone | Ticket status, CRM field, customer email and a downstream workflow sit in one action list. Three are reversible, one is not, and the rollback layer is designed for the three. | Actions are split by reversibility. In-system writes carry their previous value on the record, so the undo is one write. Anything that leaves the building or touches money becomes a proposal a person approves in one place. Reversibility without rollback |
| Drift with a 200 OK | An upstream field is renamed or a scope changes. The call succeeds, the agent rationalises the gap and reports at full confidence. | Provenance on every record: system, author, date and the verbatim passage. Drift stays visible in the quote when the structured value looks unchanged. A source that did not answer is named on the page, never silently skipped. |
| The review nobody owns | The same signal opens two reviews, a lost chat card closes one, two people work the same row. | One review per signal, deduplicated by construction. A review stays open until a person decides it. A decline and a dedup are audited decisions. |
| The approver who sees a paraphrase | The card shows the agent's summary of what it intends. The tool arguments that run differ from it. | Approval binds to the original arguments, verbatim. The receipt on the card is the write that happened, not the plan. |
The operating model: three layers, one gate
Context that knows who is asking. The layer holds no permissions of its own. Every read of chat, tickets, wiki, CRM, mailbox and meeting notes runs delegated, as the signed-in person, with membership resolved from your directory groups at question time. A hit the asker may not open is dropped without a count. Every item cites the passage that put it in front of them.
Actions a person owns. A proposed write is staged as pending and posted as a card in chat: the source, the resolved customer, the exact write. Nothing lands in tickets, the wiki, chat or the graph until a person taps Approve. That holds on every door, including the MCP door an editor or assistant connects to: an assistant can propose, it cannot accept. The receipt stays on the card.
Assurance that survives next quarter. An append-only audit trail that keeps the declined and the deduplicated next to the confirmed. Rollback of a confirmed action is compensation, never deletion. Gap telemetry per source from day one, so value is measured per system and adoption per door, never per person.
The pattern behind the gate is written up in the Human-in-the-Loop Approval Flow Blueprint. The place where it runs is the operational context layer.
Ten guarantees your security review can test
- Delegated permissions only. No service account with everything.
- Nothing is written without a human tap, on every door including MCP.
- The same signal never opens a second review.
- A review stays open until a person decides it. Two people never work the same row.
- Provenance on every record: the mention cited, or the item dropped.
- Rings rank sources, never people. No score sits on a colleague.
- HR and personal data excluded in depth. Commercial terms never travel.
- Append-only audit trail, including declines and dedups. Compensation, never deletion.
- Gap telemetry per source from day one.
- Data residency stated precisely: compute and storage in the EU, inference named per model.
Each guarantee has a ten-minute check you can run on your own agent today: the agent control self-check.
Operational context layer, DACH B2B technology company, own EU cloud tenant. Six sources folded per customer on one radar, every fact signed by a person, every write approved in chat, every step audited. Adoption is measured from audit events per door, never from opinions. Read the case study
Who this is for
CTOs, VPs of Engineering and heads of IT in DACH companies with 50 to 500 people, on Microsoft 365 or Atlassian with HubSpot or Salesforce, who have decided that an assistant will act on the systems of record and now need it production-ready, controlled and operational. The decision has been taken. The write path has not been built. That is the moment this work starts.
The way in
Four steps, each accepted on its own. The first is free, the second has a fixed price, and none of them commits you to the next.
- 1Architecture call, 30 minutesYou bring the agent you run or plan. I bring the ten guarantees. We find the write path and the first door.
- 2Write-path review, fixed priceThe AI Pilot to Production Audit: your routing rules, the measured ratio of what reaches a human today versus what should, and the three rules that pull that number down. A document for security and procurement.
- 3Phased build on your tenantFirst door, first source, first approval card in the chat your team already uses. Milestones accepted one by one.
- 4OperateAudit events per door, gap telemetry per source, and the reviews that may move from the tap to review-after-the-fact once the trail shows they are clean.
Go deeper
Frequently asked
What is AI agent control, compared to guardrails or prompt rules?
Guardrails shape what the model says. Agent control decides what the agent is allowed to do to your systems of record and who signed for it: which reads run as whom, which writes need a person, what the approver sees, what the receipt records, and how a wrong action is compensated. It lives in the harness around the model, never in the prompt.
Does a human tap before every write slow the team down?
It is one tap on a card in the chat the team already uses, and the card carries the source passage and the exact write, so nothing has to be looked up. What removes work is the other direction: the change radar and automatic sharing take away the six morning checks. Reversible in-system writes can move to review-after-the-fact per action class once the audit trail shows they are clean.
What does the write-path review cover?
The routing rules of the agents you already run: which proposed actions reach a person today, which should, and the three rules that pull that number down. You receive a document you can hand to security and procurement, with the measured ratio and the changes in priority order. It is the AI Pilot to Production Audit at a fixed price.
We use Microsoft 365 and Atlassian. Does this need a new tool?
No. Approval cards live in the chat you have, proposals are drafted in the target system in its own status, and reads use the permissions you already maintain in your directory groups. The layer runs on your own cloud tenant. Claude, Codex and other MCP-enabled applications connect through the same gate.
Where does the data go, and is inference in the EU?
Compute and storage run on your own cloud tenant in the EU. Language-model inference is stated precisely per model and is not automatically limited to the EU. That sentence goes into the review document on purpose, because a security review will ask it.
Who is this not for?
Teams that still have to decide whether an assistant should touch their systems at all, and products whose value is the evaluation itself. This work starts after that decision: you have decided the assistant will act, and it has to be production-ready, controlled and operational before it does.