What does AI agent governance look like for a small business?
AI agent governance for a small business means every agent has a named owner, its own identity, the least access that does the job, a log of what it did, a way to shut it off, and a person who approves anything that cannot be undone. Most checklists stop there. The control they miss is the sequence: an agent that respects every single-action limit can still do harm through many small actions in a row.
Give every agent an owner and its own identity
An agent that acts on your systems is a member of staff that never sleeps, and it needs the same paperwork. Start with a named person who owns it: who asked for it, who answers for what it does, and who decides when it is retired.
Then give it its own identity instead of a borrowed login. NIST's identity researchers argue that agents should be treated as first-class entities with their own unique identifiers, bound to the identity of the person or system operating them. They also point out that an agent running commands under a person's own authorization undermines non-repudiation, because the log can no longer tell the person and the agent apart. A separate account for each agent keeps the record honest and makes revoking access a single step.
Least access, and a person approves what cannot be undone
OWASP names this failure Excessive Agency: damaging actions taken because a model produced unexpected, ambiguous, or manipulated output. Its root causes are excessive functionality, excessive permissions, and excessive autonomy. Each one has a plain fix. Give the agent only the tools the job needs. Limit those tools' permissions to the minimum necessary, the same least privilege principle NIST's control catalog has carried for years. And require a human to approve high-impact actions before they happen.
For a small business, high impact usually means anything that leaves the building or cannot be taken back: sending email to a customer, posting in public, paying or refunding money, deleting records, changing who has access. Drafts, summaries, and research can run on their own. The agent prepares the action, and a person presses send.
The sequence test most checklists skip
Per-action limits are necessary and not enough. Suppose an agent may send a refund only below a set amount, or send one email per approval. Every single step passes the check. Now the agent issues many refunds in a row, each just under the limit, or works through a list of recipients one approved message at a time. No rule was broken, and the result is exactly what the limit was meant to prevent. Banks have watched people do this to transaction limits for a long time.
So set limits on totals as well as on single actions: a budget per day, a cap on messages per hour, a ceiling on records changed per run. Review the run, not only each step, and ask whether the sequence still matches what the person who started it intended.
Logs, budgets, and a kill switch you have tested
Every action an agent takes should be written down before it happens: what it was asked to do, which tool it used, on whose behalf, and what changed. A log written after the fact can miss the action that failed halfway. Keep the log where the agent cannot edit it, and read it on a schedule, not only after something goes wrong.
Budgets belong in the same place. An agent that spends money on model calls, ads, or services should stop when the budget runs out, not send an alert and carry on. And the kill switch has to be real: one action, available to the owner, that revokes the agent's access and stops its runs. Test it the way you test a backup restore. A kill switch nobody has pressed is a hope, not a control.
Use a framework you can grow into
A small business does not need a governance office, but it benefits from borrowing a structure. NIST's AI Risk Management Framework is voluntary and organized around four functions: govern, map, measure, and manage. Govern is the owner and the rules. Map is knowing which agents exist and what they touch. Measure is the log and the review. Manage is the approval, the budget, and the kill switch.
For the agent-specific risks, OWASP published its Top 10 for Agentic Applications for 2026 in December 2025, alongside its long-standing list for applications built on language models. Read both once, note the risks that apply to the agents you actually run, and check each new agent against them before it gets access to anything real.
How we run it
We operate agents for clients on LTFI, and the controls on this page are the ones we hold ourselves to. Each agent has an owner and its own identity. It gets the tools its job needs and nothing more. Anything that posts, sends, pays, deploys, or deletes waits for a person to approve it. Budgets stop spending when they run out, and every action is logged before it runs.
Security is a byproduct of good engineering, and agent governance is the same idea applied to software that acts on its own. If you already have agents running and are not sure what they can reach, start there. First conversation is free, and an inventory of what your agents can touch is a good first agenda.
Questions
What is an AI agent kill switch?
A single action that revokes an agent's access and stops its runs, available to the agent's owner at any time. It only counts as a control once someone has tested it and watched the agent stop.
Who should own an AI agent at work?
A named person who asked for it and answers for what it does. That person approves its access, reviews its log, holds the kill switch, and decides when the agent is retired.
Should an AI agent need human approval before sending email?
Yes, for email that leaves the company. OWASP recommends human approval for high-impact actions. Let the agent draft the message and have a person send it, with a cap on how many per hour.
Does an AI agent need its own login?
Yes. An agent working under a person's own login makes the log unable to tell them apart. Its own identity, tied to the person who operates it, keeps the record clear and revocation simple.
Does a small business need an AI governance framework?
It needs the controls more than the paperwork. NIST's AI Risk Management Framework is voluntary and works as a checklist: govern, map, measure, and manage the agents you actually run.
Sources
- NIST: Why Agentic AI Needs a Strong Identity Foundation. Agents should be first-class entities with their own unique identifiers, bound to the user or system operating them. Agents running commands with user authorization undermine non-repudiation.
- OWASP LLM06:2025 Excessive Agency. Root causes are excessive functionality, permissions, and autonomy. Limit extension permissions to the minimum necessary and require a human to approve high-impact actions.
- OWASP Top 10 for Agentic Applications for 2026. Published December 9, 2025. The agent-specific risk list from the OWASP GenAI Security Project.
- NIST AI Risk Management Framework. Voluntary framework organized around four functions: govern, map, measure, and manage.
- NIST SP 800-53 Rev. 5: Security and Privacy Controls. The NIST control catalog, which includes least privilege (AC-6) and audit logging controls.
More in Protect
- Agentic Security
AI-driven penetration testing that thinks like an operator.
- Penetration Testing
Authorized attacks that find vulnerabilities before real attackers do.
- Vulnerability Management
Finding vulnerabilities is step one. Fixing them is the whole point.