How Enterprises Govern Agents Through Authorization, Audit, and Human Sign Off

An enterprise agent that releases a purchase order creates an obligation the company has to honor once a supplier acts on it. Enterprises deploying agents have to answer three questions first: what the agent can reach, what it can change, and which of its actions require a person. The systems that hold the data and grant the permissions are where those answers get enforced. Most of the governing happens before the agent starts work.

Reda Miraoui is a Data and AI Architect and Expert Technology Advisor at SAP, where he designs enterprise landscapes and the agentic systems running inside them. He has spent twelve years across the SAP ecosystem, moving from development work on analytics and cloud products into enterprise architecture for DAX 40 clients. As an AI Fellow, Miraoui conducted applied research on large language models and retrieval augmented generation. His current work covers multi agent orchestration, evaluation, and deterministic guardrails.

"Regardless how the technology of LLM will progress, we will always need some form of human in the loop. The reason being is not about the intelligence. We do not have any kind of regulations that give responsibility when AI does something wrong," says Miraoui. An agent can retrieve the correct record, reason correctly about it, and still take an action before anyone has approved it. Miraoui builds his controls for that case, and he starts by looking at how governance has arrived in other industries.

Governance arrives after capability

Miraoui expects governance questions to arrive only after a technology proves what it can do. The attention now going to agent oversight tells him enterprise AI has reached that stage. "It goes from the incubation, the evolution, the capability, and then it goes down to the more boring topics like compliance and governance," Miraoui says. "You can see when the first car was produced and when we had rules about the seat belt."

The rules that come first are the ones any development team agrees on before shipping code. They cover how changes get pushed, how versions are tracked, and what has to clear a test system before anything reaches production. Miraoui applies those same expectations to any system that acts, whether the intelligence behind it is artificial or human. "All of these best practices, they generalize very well across industries," he notes. "Regardless of what industry you are working in, you still have to have boundaries."

Organizations go further when more is at stake. Miraoui sets a badly written document against an action carrying legal or financial consequences. Fixing a bad document costs almost nothing. Getting the action wrong can cost a great deal, so it gets controls the document never needs. "Some industries might need more governance," he explains. "If you are doing something that is life critical, or something with law or with taxes, then you might need a different layer of governance."

The sign off stays human

Miraoui's comparison to software development has a limit. A developer works inside a system built to tolerate mistakes, where version control and test environments catch them before anyone outside sees a result. Neither of those protections exists once an action leaves the system. "Software is a very specific category because I can all the time write a Ctrl+Z" he adds. "I can always do undo. This is not something you can do in enterprise, and once I send a quote to a customer, it is legally binding."

Miraoui lists financial reports, tax filings, and purchase orders as work an agent can prepare in full. Each one leaves the company through a named individual. He traces the requirement to how society assigns responsibility, which puts it beyond the reach of any technical improvement. "I am the human," Miraoui notes. "Whatever the AI provides, I have to give it my sign off." The requirement holds even where the liability formally belongs to the company. "You can say legal entity as a company, but at the end of the day a human is linked to that legal entity," he adds.

Liability of that kind shapes what model providers are willing to sell. Miraoui has seen no sign that any of them intends to change the unit of sale. He points to data protection penalties as the size of the risk an insurer would have to underwrite. "I don't see any way coming that a provider will say, 'We no longer sell you tokens, we will sell you the outcome,'" he says. The exposure stays with the enterprise running the agent, which then has to design controls it can defend, covering what the agent reached as well as what it released.

Controls beyond human approval

An organization could require approval for every action an agent takes. Doing that returns the work to the person the agent was supposed to take it from. Miraoui moves the checking into the run itself, so the person approving at the end sees work that has already been checked. "Human in the loop is only one mechanism, and it is not enough," he explains. "This is why there are other mechanisms, things like the governance, things like observability."

Observability supplies those checks. Miraoui reconstructs a completed run from the traces it leaves behind. He manages the agent itself the way an organization manages an employee, with a defined scope of access on arrival and removal once behavior stops matching instructions. "When you run an agent in production, you want to understand with what authorization he ran," he observes. "Did he have this authorization? What action did he do?"

Some rules in an enterprise system were settled long before any agent arrived, and Miraoui warns against handing those to a model to interpret. A rule that produces the same output every time costs less to run and leaves nothing to verify afterward. "There are accounting rules when I am trying to do my financial reporting, and these accounting rules do not have to be reinvented," Miraoui adds. "It doesn't need an LLM to reason about it." Deciding what to leave alone is as much of the design as deciding what to automate.

Boundaries and the legal gap

Miraoui pushes back on treating a more capable model as grounds for widening what it can do, and he argues that added capability is a reason for tighter limits. His evidence comes from how recent models handle instructions, and he finds it in published research as well as in the accounts of developers he works with. Added reasoning ability brings broader tool use and attempts to work around sandbox restrictions, and a governance framework has to account for both. "We should not confuse intelligence with authority," he notes. "You should not expect that with more intelligence you will have more trust, or more benevolence, or any kind of behavior. Expect the opposite." Authority gets granted from outside the model, by the permissions the enterprise system issues, by the person whose name goes on the result, and by the law that decides who answers for it.

Enterprise software already answers the question of what a user is allowed to do. A user can call the interfaces and endpoints their authorization permits and nothing beyond them. Miraoui applies the same structure to agents, putting the limit on what an agent can call inside the systems holding the records. "You still need to provide a map that is not extendable," he points out. "It is a fixed map where the agent, no matter how smart he is, will just be in those boundaries."

Miraoui expects the next constraint to appear outside the technology. Autonomous driving is the case he raises. The legal questions there arrived while vehicles were already on public roads, and he expects the enterprise version to follow the same order. "Even if we solve the problem of governance, the other thing is whether we have rules and laws in the outside world that fit this new agentic world," Miraoui concludes. "I don't think it is any more a question of technology, it is rather a question of what that means in the legal system."