A Chief Information Officer (CIO) at a $5M to $50M company governs AI agents with 5 controls: a separate identity for each agent, permissions scoped per system, logged connections, action-level monitoring, and an inventory entry with a named owner. Put all 5 in place before an agent writes to a single production record.
Agents are a new kind of user in your systems. CyberArk’s 2025 research counted 82 machine identities for every human one, and 68% of organizations had no identity security controls for AI.
At a company your size, “CIO” might mean an IT director, a 3-person team, or a managed service provider. This page is for whoever owns the ERP, the CRM and Microsoft 365.
Create a dedicated account for each agent in your identity provider, name it for its job, assign a named human owner, and grant only the systems and actions that job needs. Use 3 permission tiers per system: Read, Draft (writes held for a person to approve), and Act (writes directly, within written caps).
An agent running on a staff member’s login causes 2 problems. The audit log shows that person doing things they never did, and the agent breaks the day their account is disabled.
A separate account fixes both. Name it so anyone reading a log knows what it is, such as `agent-ap-invoice-intake`, and tag it with the owner’s name.
NIST’s National Cybersecurity Center of Excellence opened a project in February 2026 on how identity standards apply to software agents. Its concept paper asks about identification, authorization, auditing and non-repudiation for agents.
The controls it asks about already exist in the directory you use for staff accounts: unique accounts, group-based access, expiring credentials and sign-in logs. Start with those now.
| Tier | What the agent can do | Example | Gate to move up |
|---|---|---|---|
| Read | Query records and read files | Summarize open tickets from HubSpot each morning | Owner signs the Agent Card |
| Draft | Prepare changes that wait in a queue for a person | Prepare a new hire’s group memberships for IT to approve | 30 days of logs with no unexplained actions |
| Act | Write directly, within caps written on the card | Close duplicate how-to tickets, up to 20 a day | Owner and CIO both sign the change |
Tiers apply per system. An agent can hold Act in the ticketing tool and Read in the ERP at the same time.
Store every agent’s keys in a secrets vault, use short-lived tokens where the system supports them, and rotate long-lived keys at least every 90 days. OWASP’s Top 10 for Agentic Applications, published December 2025, lists identity and privilege abuse among the top risks for agents.
Agent vendors often tell you to connect your own account, prove the pilot, then tighten access later. I set up the agent’s own identity and the Draft tier on day 1.
My reason is simple. Access granted during a pilot rarely gets reduced, because no one wants to break the first thing that works.
Setting up a service account takes about an hour. Untangling an agent from a departed employee’s login takes days, and you lose the audit trail for everything it did before.
Connect each agent through the system’s API with a token issued to the agent’s own account, scoped to the fields its job uses, and route every call through a layer that logs it. Start with Read access to 1 or 2 systems, because Gartner expects over 40% of agentic AI projects to be canceled by the end of 2027.
Gartner’s June 2025 prediction named rising costs, unclear business value and inadequate risk controls as the reasons. Gartner also estimated that only about 130 of the thousands of vendors selling “agentic AI” offer real agents.
At $5M to $50M, you have 3 ways to connect an agent to a system:
All 3 let you put a logging step between the agent and the system of record. Pick the lightest one that does the job.
Put a hard cap on writes per hour for every agent with Draft or Act access. An agent stuck in a retry loop can post thousands of updates in an hour, and a cap of 100 turns that into a contained incident.
The Model Context Protocol (MCP) is the open standard many agent tools use to reach business systems. Its June 2025 authorization spec builds on OAuth 2.1 and requires each MCP server to accept only tokens issued specifically for it.
The same spec forbids an MCP server from passing a client’s token through to downstream APIs. Ask every vendor whose MCP server you connect to confirm both points in writing.
Rolling Microsoft 365 Copilot out to staff is a separate project, covered in AI for the Chief Information Officer.
Log 5 things for every agent action: the agent’s ID, the trigger or request, each tool call with its inputs, the system and records touched, and the result or error. Then review 4 numbers every week: actions per day, error rate, human overrides, and cost per completed task.
Keep the logs somewhere the agent can’t edit. If the agent can write to its own log, the log proves nothing.
Set alerts for 4 events:
The override rate is the number I watch most. If people reverse more than 1 in 10 of an agent’s Draft-tier changes, it stays in Draft, and the owner rewrites its instructions.
Cost per completed task catches the other failure. Gartner listed rising costs first among its reasons for canceled agent projects, and model usage can creep up as an agent’s instructions grow.
The weekly review takes about 15 minutes per agent once the dashboard exists. Put it on the owner’s calendar, with IT reviewing a summary across all agents once a month.
Keep 1 register with a row per agent, and give each row 5 fields: owner, identity, scope, kill switch, and evidence. Refresh it monthly from your identity provider, your Zapier and Make.com accounts and your vendors’ admin panels, because departments build agents in places IT never sees.
Agents show up in more places than most IT teams expect. Check Zapier and Make.com accounts, GoHighLevel and HubSpot workflows, Microsoft tenant apps, and every OAuth grant a user has approved for a third-party tool.
For agents built in Microsoft’s tools, the Copilot Studio agent inventory lists each agent in the tenant with its creator, owner, authentication mode and connectors. Microsoft updated that documentation in June 2026, and it covers only Microsoft-built agents.
Fill in this card for every agent before it touches production. It’s 5 fields, and an agent with any field blank stays at Read.
| Field | What it records | Pass test |
|---|---|---|
| Owner | A named person, by role and name | The owner can explain what the agent did yesterday |
| Identity | The agent’s own account and where its keys live | Separate account, keys rotated in the last 90 days |
| Scope | Each system, its tier (Read, Draft, Act) and its caps | Every permission maps to a task written on the card |
| Kill switch | How to stop the agent and who can do it | Either of 2 named people can stop it in under 5 minutes |
| Evidence | Where the logs live and how long they’re kept | The last 30 days of actions come back in 1 search |
The register is just these cards in one spreadsheet or list. Review it in 30 minutes a month.
During an AI inventory review at a business services company, the IT team found a Microsoft Power Platform flow built for a sales pilot. It read incoming messages from a shared sales mailbox, sent their contents to an AI service for summaries, and wrote notes into Salesforce.
The workflow was still running. It wasn’t in the integration register or the support inventory, and no current employee was accountable for it.
A permissions review showed its connections could read every message and attachment in the shared mailbox, plus read and update Salesforce accounts, contacts and opportunities. Writing a summary note needs a fraction of that access.
The team’s fix follows the incident steps in the next section:
The inventory entry now records the workflow’s purpose, owner, connected systems, data access and next review date. That covers most of an Agent Card. Add a kill-switch holder and the log location, and the card is complete.
The agent’s named owner is accountable for what the agent does, and the CIO is accountable for the systems that let it act. Write both names on the Agent Card before launch, along with a rollback plan, so a bad write gets reversed in hours by someone who already knows the agent’s job.
The owner should be the person who owns the business process. The accounts payable lead owns the invoice-intake agent, and IT owns the identity, the connections and the logs.
When something goes wrong, run the same 4 steps every time:
OWASP’s 2026 list names cascading failures and rogue agents as top risks. Both get worse when an agent can change its own access, so keep every agent at Read on its own permissions.
Anything touching money, customer records or access rights stays in Draft, with a person approving each change. I hold that line even after the logs look clean, because those are the mistakes that are hardest to reverse.
In a 3-person IT team at a $20M company, agents that triage failed syncs, prepare access changes, answer how-to tickets, check permission drift and flag unused licenses can give back about 14.5 hours a week. Every one of them runs in Draft, so a person approves each change before it posts.
The hours below are planning assumptions from the kind of week I see at this size. Replace them with your own 2-week baseline before you budget against them.
| Task | Hours/week now | With agents | Hours given back | Mechanism |
|---|---|---|---|---|
| Triage failed syncs between ERP, CRM and accounting | 5 | 1.5 | 3.5 | Agent reads the Zapier, Make.com or Python error log, groups failures by cause and drafts the replay; a person approves it |
| New-hire and role-change access setup | 4 | 1 | 3 | Agent checks the request against the role matrix and prepares the group changes for IT to approve |
| Business-app how-to tickets | 6 | 3 | 3 | Agent answers from your SOP library and hands the ticket to a person after 2 failed attempts |
| Weekly permission drift check | 3 | 0.5 | 2.5 | Agent compares this week’s user and group exports with last week’s and flags new admin rights |
| Microsoft 365 license and mailbox housekeeping | 3 | 0.5 | 2.5 | Agent lists inactive accounts and unused licenses for IT to remove |
| Total | 21 | 6.5 | 14.5 |
Every row gives back at least half of the task’s time. That clears my 20% rule: if an agent would give back less than 20% of a task’s time, cut the task and skip the agent.
Agents cost money to run and time to watch, so here’s the net number.
Gross capacity from 5 IT agents
That’s 14.5 hours a week your team puts back into projects that were stuck in the queue. Run your own numbers in the AI ROI Calculator before you build anything.
Smaller companies are behind on this. McKinsey’s 2026 State of AI survey found 40% of respondents from organizations over $1 billion in revenue were scaling agents, while the share at smaller organizations stayed flat at 22%.
I think most of that gap is ownership. At a $20M company, no one has the 2 hours a week to watch the agents, so the agents never leave the pilot.
Ordered people first, then process, then tech. Each step names who does it and what it produces.
Days 1 to 30: people
Days 31 to 60: process
Days 61 to 90: tech
I’m Lee Pomerantz, Certified Chief AI Officer, founder of eMediaAI, Fort Wayne, Indiana. I build and govern agents for leadership and IT teams at $5M to $50M companies, in one order: people first, then process, then tech.
Every engagement starts with the AI Opportunity Blueprint™, a 10-day, $5,000 forensic audit. Your staff record the tasks, I map where the hours and the data go, and you get a prioritized workflow map, an ROI projection, an implementation roadmap and governance recommendations.
For agents, the Blueprint shows which workflows earn an agent and which tasks should be cut. When a build goes ahead, my AI agent builds ship with error handling, a governance document and a handoff your team runs without me.
AI agent governance is the set of controls deciding what each AI agent may access, what it may change, who answers for it, and how its actions get recorded. At a $5M to $50M company it usually comes down to 5 items per agent: a named owner, a separate account, permissions scoped per system, a way to stop it within 5 minutes, and logs kept where the agent can’t edit them.
2 public references give IT leaders a starting framework for agentic AI governance, and both are still early. OWASP published its Top 10 for Agentic Applications in December 2025, listing risks such as identity and privilege abuse and tool misuse. NIST’s National Cybersecurity Center of Excellence released a concept paper in February 2026 on identity, authorization and auditing for software agents.
The biggest risk is an agent holding more access than its job needs, because every mistake or manipulated instruction then reaches further. CyberArk’s 2025 research found 42% of machine identities hold privileged or sensitive access. Limit each agent to Read, Draft or Act per system, cap writes per hour, and keep anything touching money, customer records or access rights behind a human approval step.
The Model Context Protocol (MCP) can be used safely in a business when each MCP server follows the June 2025 authorization spec. That spec builds on OAuth 2.1, requires each server to accept only tokens issued for it, and forbids passing a client’s token to downstream APIs. Get written confirmation from each vendor, give the connection its own scoped account, and log every call it makes.
An AI agent should run on its own dedicated account with a named human owner. An agent on an employee’s login makes the audit trail show that person taking actions they never took, and the agent stops working the day that account is disabled. A dedicated account takes about an hour to set up, with keys stored in a secrets vault and rotated at least every 90 days.
Running an AI agent at a mid-sized company typically costs a monthly model and platform fee plus owner review time. As a planning assumption, 5 agents at $200 a month each come to $12,000 a year, and 2 hours a week of reviews at the BLS full-time rate of $54.00 an hour adds $5,184. Get real vendor quotes, because usage-based model costs rise as an agent’s workload grows.
Managing AI agents takes about 15 minutes per agent per week for the owner’s log review, plus 30 minutes a month for IT to review the agent register. Setup takes longer: plan on roughly an hour to create each agent’s account and a few hours to configure logging and alerts. A team running 5 agents should budget about 2 hours a week once everything is live.
Measure an AI agent’s ROI against a 2-week baseline taken before launch: hours per week on the task, multiplied by a loaded hourly rate, minus model costs and review time. At $54.00 an hour over 48 weeks, 14.5 hours a week given back is worth $37,584 a year gross. Track the human override rate too, because reversed changes cost time.
An IT leader’s first move with AI agents is a discovery sweep: list every API key, OAuth grant, Zapier or Make.com connection, and vendor agent already touching company systems. Give each one a named owner and a 5-field Agent Card (owner, identity, scope, kill switch, evidence). Then pick 1 workflow, baseline its hours for 2 weeks, and launch it at Read access only.
Book a free 20-minute call to see if the AI Opportunity Blueprint™ is right for you.
Book Your Call
© 2026 eMediaAI.com. All rights reserved. Terms and Conditions | Privacy Policy
