Drawn from customer projects and our own operations. We are happy to answer any questions in an initial call.
It has been a long time since companies first asked Haavest what an agent can do. Now they ask what it is allowed to do, and who keeps that in check. We think that is the right way round. Frankly, we are relieved the question comes up. We hear three questions in almost every organisation, and each one has an answer you can write down and verify.
Who is allowed to build agents in your organisation?
First and foremost, this is about roles, approvals and a clear separation of environments. An agent is built and tested in a development environment. It only goes into production after sign-off, like any other software. The rules for this are written as code in the platform, where they are enforced. A PDF on the intranet, by contrast, is only ever read.
What are agents allowed to see?
Each agent gets its own managed identity with the fewest permissions possible. Data is classified and protection policies are enforced before an agent touches it. When an agent acts on behalf of a person, it sees only what that person would be allowed to see. That sounds obvious, and with the right setup it is.
How are they monitored, and how do you stop them?
With an inventory of every agent and a log of every action, plus a defined kill switch and regular reviews. The goal is simple: a year from now, you should still know which agents are running in your organisation, what they are allowed to do and who owns them. If you can answer that, you can build the next agent with confidence.
For us, this baseline is the first phase of every go-live. It is always part of how we work. It can also be commissioned on its own, for instance if you already run agents and want to get them in order first. What comes out of it stands up to internal audit, and your data protection officer and works council can read it without us sitting beside them.
