Most conversations about AI agents in business start with what the agent can do. In our experience, that is rarely what stops adoption. The harder issue is access. To be useful, an agent needs to connect to your systems, and the usual grant is broad and permanent.
Security teams have a good reason to block standing access
An agent with standing access to a mailbox, a document store or a database is a credential that can act on its own initiative. If it behaves unexpectedly, the blast radius, meaning the damage or exposure, is whatever you granted. Security teams that block this are applying the same standard they would apply to any other integration.
Scoped permission changes the approval question
The alternative is permission bounded in three ways at once:
- Scoped to a single run rather than to the agent.
- Expired when the run ends.
- Revocable while the run is in progress.
Nothing the worker did not declare in advance can be touched at all.
That is the model we built into BotUp. It changes the conversation from “do we trust this agent” to “do we approve this one job”. The second question is far easier to answer. The person who wants the work done can answer it, rather than only a security review.
The access request belongs in the listing
If a worker needs to read something, that requirement is published before checkout alongside the price. Discovering during a run that a tool wants access you had not anticipated destroys trust. It is entirely avoidable.
Each run needs a record people can inspect
Every run is metered and logged. The result includes what was accessed and what it cost. That record is what makes an agent auditable. Auditable is the precondition for a regulated business using one at all.
Bounded access decides whether the capability gets used
Capability is improving quickly and will keep improving without our help. The unglamorous work of bounding what an agent may touch decides whether any of that capability gets used in a business that has something to lose.
