Good agent permissions work on two levels. First, an agent may only do what the person asking may do. Second, risky steps, like a push to main, wait for a person's yes. Bill & Ben works this way and keeps an audit log.
This post explains both levels. It ends with questions you can ask any vendor.
Why does an AI agent need permissions at all?
An agent can act, not only talk. Ben, for example, opens branches and draft pull requests. If an agent could act for anyone, one wrong message would be enough to cause damage.
So the first rule is simple. The agent must not be able to do more than the person who asks.
What can the agent do only for the person who asks?
Bill and Ben can only do what the person asking is allowed to do. Each request is checked against what that person may do, at the moment they do it.
Your admin sets who may ask or command an agent. Nobody is in by default. A first message from a stranger does not create an account.
The same rule holds on the shared board. Pressing Execute is always a person's act. An agent can never do it. Agents also cannot approve their own plans. Only a person accepts or runs a plan on a board.
Which steps wait for a yes?
Pushing code, writing to work items or editing the wiki waits for a person's yes. "Push to main" waits for an approval. Anything outside the rules is stopped.
Not everything needs a yes. Ben's own branches, draft pull requests and comments are the exception.
| Step | What happens |
|---|---|
| Push to main | Waits for an approval |
| Write to work items | Waits for a person's yes |
| Edit the wiki | Waits for a person's yes |
| Ben's own branch, draft pull request, comment | Goes ahead without a yes |
Who can approve, and who never can?
An agent can never approve its own plan.
In Teams, the approval is a card with Approve and Deny buttons. It arrives in your direct chat with the agent, not in the group chat. Some details:
- An approval covers one action and exactly its details, and it works once.
- It expires after 10 minutes.
- The person who clicks must hold the same permission.
- You can always deny your own request.
- If the card cannot be delivered, the change stays blocked.
What happens when the permission check cannot be made?
The answer is no. If the check cannot be made, the answer is no. The agent does not start, and in Teams it tells the person to try again shortly.
This is the safe default. If the check fails, the answer stays no.
How do admins see what happened?
Admins see who asked for what, and what happened, in the audit log. It records sign-ins, role changes, denied requests, exports and deletions. You can see who asked for what, what ran and what was blocked. Export it on Business.
When Bill and Ben staff act as one of your users, your audit log records it.
We make no SOC 2 claim today. This post describes what the product does. It is not a certificate.
What should you ask any vendor about agent approvals?
Here are six questions to ask. They work for any product.
- Can the agent do more than the person who asks?
- Which steps need a person's yes, and can you change the list?
- Can the agent approve its own plan?
- What happens if the permission check fails?
- Can your admins read a log of who asked for what?
- What is a draft or a plan, and what is already working today?
Ask for the answers in writing.
If you want to try Bill & Ben, you can start free for 14 days. See the pricing page. The docs have a security page and a page on permissions and roles.