Is Your Company Ready for AI Agents? A 20-Question Checklist on Approval, Permissions and Audit Trails

On 24 April 2026, an AI coding agent at a US software company hit a credentials error during a routine cleanup. Instead of stopping to ask, it used an API token it should never have been able to use and wiped a storage volume. The volume held the production database and every backup. It took about nine seconds.

The model was not the main problem. The reported failures were ordinary ones: a token with far more authority than the task needed, no human approval before a destructive action, and backups stored beside the live data. Those are governance gaps, and any company giving agents access to real systems can have them.

This is not a rare story. Cyera analysed more than 7,000 publicly reported AI incidents and verified 344 enterprise cases of "agent-inflicted damage" between September 2023 and May 2026, 188 of them direct harm in production with no attacker involved. Its top root causes were excessive standing permissions, destructive commands run without a confirmation step, and missing action logs.

Ownership is the other half. In a 2026 Infor survey of business decision-makers (fielded by YouGov), 21% of Japanese enterprises said no one person owns AI governance, risk or compliance. That is the highest rate of the markets surveyed (10% globally, 4% in Singapore).

So before you give an agent access to your ERP, mailbox or database, it is worth asking a plain question: are we ready? Below is a 20-question self-check. It takes about ten minutes.

How to score

Answer each question Yes (2), Partly (1) or No (0). Be honest. "Partly" means it exists on paper or for some agents, not all. The maximum is 40.

A. Ownership and policy

1. A named person (not a committee) owns AI agent risk and governance.
2. You keep an up-to-date list of every agent and AI tool connected to company systems, including ones staff set up themselves.
3. A written rule says which actions an agent may take on its own and which need a human.
4. There is a defined path for reporting and handling an agent mistake, and people know it.

B. Access and permissions

5. Each agent has its own identity and credentials, not a shared admin token.
6. Permissions are limited to the task: read-only where possible, with delete, pay and send rights granted separately.
7. Credentials are kept where an agent cannot read them from files, logs or environment settings.
8. Production, test and staging are separated, and an agent in one cannot reach another.

C. Approval and control

9. Irreversible actions (delete, bulk write, payment, deployment, external email) need a recorded human approval.
10. You can see who approved what and when.
11. Each agent has spending and call-rate limits and a loop breaker.
12. You can stop any agent immediately and revoke its access in one step.

D. Audit and recovery

13. Every agent action is logged with who it acted for, which tool it called, and what data it touched.
14. Logs are kept somewhere the agent cannot change.
15. For any change, you can answer who or what made it and why within a day.
16. Backups are stored outside the agent’s reach, and you have tested a restore.

E. Data and fit

17. You have decided which data classes an agent may see, and where that data is processed (see your privacy obligations; this is not legal advice).
18. Third-party and vendor agents have been reviewed for what they can access and retain.
19. Your first use case is narrow, with a named business owner and a measurable outcome.
20. Someone has estimated the running cost, including model usage and the human review time.

What your score suggests

These bands are a rule of thumb, not a standard.

• 0 to 15: fix the foundations first. Start with questions 1, 5, 9 and 16. Give each agent its own identity, require approval for destructive actions, and move backups out of reach before expanding anything.
• 16 to 28: pilot with guardrails. You can run a small, supervised pilot. Close the "No" answers in sections B to D before you widen access.
• 29 to 40: ready for scaled pilots. Focus on runtime monitoring, regular permission reviews and measuring results.

What a two-week agent readiness assessment would cover

If you would like help beyond the self-check, we are considering a short, fixed-scope assessment. It would produce:

• An inventory of agents and AI tools in use, including unofficial ones.
• A permission map showing what each can read, write, delete, send or pay.
• The five riskiest actions, with a proposed approval design for each.
• Audit gaps: what you could and could not reconstruct after an incident.
• A recommended first pilot, narrow and measurable, with its owner.
• A written report and a walkthrough for your management team.

It would not be a certification, legal advice or a guarantee that nothing will go wrong. We would work from configuration and documentation, not production data. Scope and price would be fixed after a short call.

Where Simplico fits

We build identity and single sign-on, security monitoring and ERP integrations, which are the layers an agent’s access runs through. If your assessment shows you need an approval layer or tighter audit logging, we would scope that as a separate project. The assessment itself sells no product. If your question is about running a model inside your own network, our free Local LLM Readiness Assessment is a separate 25-question check.

Help us test this idea

We are validating whether this assessment is something organisations want. The most useful things you can send:

1. Your score and the section where you scored lowest.
2. One agent use case you are considering or already running.
3. What would make an assessment worth paying for, or why it would not be.

Write to hello@simplico.net with the subject "Agent readiness". We will reply with a short, honest review of your answers.

FAQ

Do we need an assessment if we only use ChatGPT or Copilot?
A chat assistant that only answers questions carries less risk than an agent that can act on your systems. Once an assistant can send email, edit files or call internal tools, the checklist applies.

Is this the same as an AI policy?
No. A policy states intentions. This checks whether permissions, approvals and logs exist in your systems and would hold up after a mistake.

Is the score a standard or a certification?
No. It is a practical rule of thumb to show where to look first.

Can agents be made safe enough to use?
Most of the incidents above came from over-broad access and missing approval or logging, not from agents being unusable. Narrow permissions, human approval for irreversible actions and good logs are what the checklist tests.

Will you review our actual systems?
Only in a paid assessment, and from configuration and documentation. Nothing in this post asks you to share credentials or production data.

Sources

• An AI agent deleted a database in nine seconds. Don’t ban it, govern it, Epic IT, June 2026
• Agent-Inflicted Damage: Inside the Real-World Failures of Enterprise AI Systems, Cyera, 28 May 2026
• Infor unveils its expanded Infor Industry AI (Japan survey findings), Infor, October 2026