Why Human Access Review Models Fall Short for AI Agents
Traditional access certification was built around human review cycles: an employee's permissions are checked once or twice a year, a manager attests to their continued need, and the record stands until the next cycle. AI agents break this model in several ways. Their permissions can change programmatically as workflows are updated, their tool invocations happen at machine speed and volume, and a single agent may operate across multiple systems, sometimes connecting to external tools through protocols such as MCP. A review cadence and evidence model designed for annual human attestation cannot keep pace with this rate of change.
What to Inventory Before a Campaign Begins
A certification campaign cannot proceed without a reliable inventory of what is being reviewed. Before launching a campaign, governance teams need a clear record of agent identities, the permissions and tool-call access granted to each one, and the systems or data sources those agents can reach. Without this baseline, reviewers have no defensible starting point for comparing granted access against actual behavior.
Ownership and Accountability Across Systems
Because agents frequently span multiple systems and teams, ownership can become ambiguous. A single agent might touch data owned by one team, execute tool calls configured by another, and be deployed by a third. A well-run campaign assigns a clear, accountable owner to each agent identity so that findings have somewhere to land, and so that sign-off or remediation decisions are not left unresolved between teams.
Practical Considerations for Running the Campaign
- Scope the first campaign narrowly to a limited set of agents rather than attempting an enterprise-wide review on the first pass.
- Treat agent identity as a prerequisite, not a parallel workstream, since certification cannot proceed without it.
- Distinguish tool-call events initiated by an agent from those initiated by a human operating through the same interface.
- Log runtime policy exceptions as they occur rather than reconstructing them retroactively from incomplete records.
- Require a documented remediation action for every flagged permission, even when the decision is to retain access.
- Set a review cadence shorter than typical annual human access cycles given how quickly agent permissions and tool integrations can change.
Where Runtime Governance Fits
Runtime governance provides the underlying evidence that makes certification defensible: accurate agent identity records, a live map of granted permissions, and a factual history of tool-call activity. Without this evidence layer, a certification campaign is limited to reviewing what was configured rather than what actually happened, which weakens the reliability of every sign-off decision made during the review.