The AI Agent has prepared the quotation, compared historical orders, and reviewed the terms. Can it now send the quotation directly to the customer? Enterprises face the same question in procurement comparisons, customer service responses, quality exception handling, system patching, and other tasks. The preliminary work can be automated by an AI Agent. What truly concerns managers is whether the AI Agent, as it continues with the subsequent workflow, will access sensitive data, make commitments on the company’s behalf, or modify production systems directly.
We believe enterprises do not have to choose between “fully automated execution” and “approval at every step.” A more practical approach is to classify each operation by risk and introduce human approval gates wherever human judgment is required. Once the AI Agent has completed the preliminary work, it pauses so that designated personnel can verify the accuracy of the data, assess the potential impact, and review the proposed next action before deciding whether to authorize it.
Whether an Operation Should Be Automated Cannot Be Determined by the Task Name Alone
On October 7, the Payment Card Industry Security Standards Council (PCI SSC) published AI security guidance for payment environments, reminding enterprises to reassess AI permissions and security mechanisms. The document recommends adopting the principle of least agency, meaning that an AI Agent should have access only to the systems, data, and execution capabilities required to complete its task. If an AI Agent needs to work with plaintext cardholder data, it should first obtain explicit human approval. Enterprises should also prioritize the use of tokenized, truncated, or encrypted data for AI systems.
This information supplement provides recommendations; the original document does not classify them as new mandatory PCI requirements. However, it proposes a practical model for dividing responsibilities: Human-in-the-loop means that every AI task must be approved by an appropriate person, while Human-over-the-loop means establishing a pre-approved scope within which the AI Agent may operate, with people continuously overseeing its actions and retaining ultimate accountability.
Enterprises can use this model to review each individual action rather than treating an entire “customer service process” or “procurement process” as having a single risk level. In customer service, for example, looking up return and exchange policies and summarizing conversations can fall within a pre-approved scope. Making a compensation commitment to a customer, however, may require human confirmation every time. IT departments can similarly allow an AI Agent to compile vulnerability information and prepare test materials, while still requiring production deployments to comply with existing change-management and security controls. The first step is to break a workflow down into specific operations and then identify which can be executed automatically and which must wait for approval.
Use Four Questions to Decide Where an AI Agent Should Stop
The same task can have different consequences at different companies. We therefore recommend that business units, data owners, IT departments, and information security personnel answer the following four questions together and record the answers in an operation classification matrix.
- What sensitive data will it access? Will the AI Agent access plaintext cardholder data, personal data, passwords, or unencrypted cryptographic keys? PCI SSC’s recommendation is clear: AI systems should not process, generate, or manage passwords or unencrypted cryptographic keys. If an operation involves plaintext cardholder data, it should require explicit human approval.
- Which people or systems could be affected? Content intended solely for internal reference carries different responsibilities from content sent directly to customers, suppliers, or regulatory authorities. External quotations, official responses, and publicly released content should be approved every time.
- Can the action be reversed if something goes wrong? A draft can be deleted or recreated, but changes to production systems, payment execution, and patch deployment carry higher recovery costs and greater potential impact. Enterprises can begin by allowing AI Agents to perform read-only queries, organize data, and prepare drafts, then gradually assess which execution permissions can be granted.
- Can the rules be clearly defined? Pre-authorization is appropriate only when spending limits, data sources, exception criteria, and approval roles can all be clearly specified. If conditions are unclear, data is contradictory, or a value exceeds the defined threshold, the enterprise should route the task to designated personnel.
At a minimum, the operation classification matrix should record data sensitivity, scope of impact, reversibility, and the party responsible for approval. After completing the classification, enterprises should test it on one existing workflow rather than assigning an entire department’s work to AI Agents from the outset.
Approval Screens Must Be Clear to Managers and Preserve an Audit Trail
An approval screen must provide enough information for the approver to understand exactly what the AI Agent will do next, which data it used, which system will be affected, and whether the action can be reversed after approval. If the screen contains only a conclusion and an “Approve” button, managers will find it difficult to verify whether the underlying assumptions are correct. If an issue occurs, it will also be harder to identify where the process failed. For example, an approval page for an external quotation could show the pricing basis, exception clauses, and recipients. A production change request should include test results, the scope of impact, and the recovery procedure.
Enterprises should also configure permissions separately for each part of the workflow. An AI Agent responsible for collecting data may require read-only access. An AI Agent that prepares proposed changes does not also need production deployment permissions. In addition, enterprises should define which capabilities and data are available based on department, role, and task. During the initial implementation stage, they can begin with read-only access and the smallest necessary data scope. Data owners and information security teams should then conduct joint quarterly reviews and revoke permissions that are no longer needed.
Enterprises using EgentWrX can configure human approval gates before a workflow advances to the next stage. After completing the preceding tasks, the AI Agent pauses and waits for human authorization. The platform can also apply layered controls based on organizational roles, determining which capabilities users may access and which data they may view, while maintaining searchable operation records whose integrity can be verified. These mechanisms allow enterprises to embed when and how people participate and approve actions directly into workflows, rather than leaving such controls confined to project presentations.
Every workflow should have a designated business owner and technical owner. They should regularly review execution and approval records and incorporate anomalous operations, skipped approval procedures, and access to high-risk data into existing incident response processes. Enterprises should also inventory production AI systems, Shadow AI, and third-party AI services, creating both an AI system inventory and an AI bill of materials (AI-BOM). Even the most comprehensive approval framework will inevitably have gaps if the company does not know which tools are being used internally. Enterprises can begin now by selecting one workflow that involves sensitive data or external commitments, documenting its operations, permissions, approvers, and records, and then deciding where to place the first human approval gate.
FAQ
Does every AI Agent operation require individual human approval?
No. Read-only queries, internal data organization, and reversible drafts can be included within a pre-approved scope after assessment. If an operation involves plaintext sensitive data, external publication, payment execution, or changes to a production environment, it should require human approval every time, with a designated person retaining ultimate accountability.
What is the difference between human oversight and human intervention?
Human intervention means that every AI task must be approved by an appropriate person. Human oversight allows an AI Agent to operate within a pre-approved scope while people continuously monitor its execution. When adopting human oversight, enterprises must still define in advance which actions may be automated and designate the person who retains ultimate accountability.
Which fields should an operation classification matrix include at a minimum?
At a minimum, it should include the operation, data sensitivity, scope of impact, reversibility, required permissions, and approval roles. Teams can also document exception criteria and stop mechanisms so that the system routes a task to designated personnel when it encounters conflicting data, unclear conditions, or values that exceed established thresholds.
How should enterprises manage generative AI tools adopted independently by employees?
Begin by inventorying production systems, Shadow AI, and third-party AI services. Record the departments using them, the types of data involved, their connectivity scope, and the responsible owners, then incorporate them into continuous monitoring and incident response processes. Once the inventory is complete, the enterprise can identify usage patterns that bypass existing approval workflows.
References
- PCI SSC Publishes AI Security Guidance for Payment Environments, Recommending Human Approval Before AI Agents Access Plaintext Cardholder Data — iThome’s summary of the PCI SSC information supplement on AI security in payment environments and its related recommendations.
