---
title: How to keep people in control of AI agents | Codivated
canonical: https://www.codivated.com/insights/ai-agent-governance/
---

[Home](https://www.codivated.com/)/[Insights](https://www.codivated.com/insights/)Governance · 6 min read

# How to keep people in control of AI agents that take actions

By the Codivated team · Updated November 3, 2026

Agents act, and people approve what matters. Before an agent goes live, sort every action it can take into three groups: what it does on its own, what needs a person's yes, and what it never does. Then log everything and give each agent an owner.

## Why does an agent need governance at all?

A chatbot answers questions. An agent takes actions: it updates an order, sends an email, applies a payment. That is where the value is, and also the risk. Governance is how you get the speed without losing control.

## What should an agent do on its own, and what needs approval?

Decide by dollar amount, customer or type of action. A simple three-tier rule covers most first agents:

| | Tier | Rule | Examples

| Acts on its own | Routine, reversible, inside policy | Answer an order status question; tag and route a ticket; draft a follow-up

| Asks a person first | Costs money, touches a key customer or is hard to undo | Issue a refund above a set amount; offer a renewal discount; change a shipping promise

| Never does | Outside the agent's job | Change prices, sign contracts, reach systems its job does not need

The thresholds are yours to set and change. Start tight, then loosen them as the agent earns trust.

## How does an approval actually work?

The agent prepares the action and sends it to the right person with the context they need. Approving takes one tap. If the person declines, the agent learns from the decision and the case is logged.

## How do you start without risk?

With a practice run. For the first weeks, the agent suggests and your team approves everything. You see what it would have done, how often it was right and where it needs tuning, before it acts on its own.

## What should be logged?

Every action: what the agent did, when, why, what data it used and who approved it. A complete record is what lets you trust an agent with more, and what you show an auditor or a customer who asks.

## Who owns an agent after launch?

A named person on your side, like the manager of a new hire. They review its results, decide when to widen its rules and raise problems. An agent with no owner drifts. Our ongoing agent care does the tuning and monitoring; your owner makes the calls.

## What about data and security?

Each agent reaches only the systems its job needs. Your data is not used to train AI models. Unusual cases always go to a real person.

Free toolWhat would your first agent be worth?Put in your team size and lead volume and get a yearly estimate in a minute.

[Estimate your ROI](https://www.codivated.com/roi-calculator/)
Related: [AI agent development](https://www.codivated.com/ai-agent-development/), [what an AI readiness assessment includes](https://www.codivated.com/ai-readiness-assessment/), and agents for [operations](https://www.codivated.com/agent-teams/operations/) and [finance](https://www.codivated.com/agent-teams/finance/), where approval rules matter most.

Written byThe Codivated teamWe build and run AI agents for established companies.[Book a consultation](https://www.codivated.com/contact/)

## Agents act. People approve.

[Ask about the First Agent Sprint](https://www.codivated.com/contact/)