AI Agents: What to Ask Your IT Provider

Did you know the word robot comes from robota, Czech for forced labour, and it first appeared in a 1920 play? A century later, businesses are handing the digital version the keys to the shared drive and asking whether that is a good idea.

It is a fair question. A chatbot that gives a wrong answer costs someone a few minutes. An AI agent that gets something wrong can send the email, move the file or change the permission before anyone has finished their coffee. That difference is why “Is it safe to let an AI agent touch our data?” has stopped being hypothetical.

The honest answer is that it depends on what the agent can reach, whose identity it is using and who is watching. In May 2026, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) published guidance that helps answer it, written with cyber agencies from the United States, Canada, New Zealand and the United Kingdom. This article turns it into questions worth putting to whoever looks after your IT.

What makes an AI agent different

An AI assistant answers. An AI agent acts. Give an agent a goal, such as chasing overdue invoices or filing the action items from this week’s client emails, and it plans the steps, uses the tools connected to it and carries them out, often with little human involvement along the way. Copilot agents inside Microsoft 365 and customer service bots wired into a CRM both sit on this spectrum.

That autonomy is what makes agents useful. It is also why they need different handling from a chat window. An agent works at machine speed, with a real set of permissions, on instructions it cannot always tell apart from the content it is reading.

What the guidance says

The guidance, titled Careful Adoption of Agentic AI Services, groups the risks into five areas:

• Privilege: the agent has more access than its task needs, so one mistake or compromise reaches further than it should.
• Design and configuration: weaknesses built in before launch, such as loosely scoped connections between the agent and your systems.
• Behaviour: the agent reaches its goal in a way nobody intended, for example by pulling in data outside the brief.
• Structural: where several agents feed each other, one bad output can travel down the chain.
• Accountability: an agent’s multi-step reasoning is harder to audit, so working out what happened afterwards takes more effort.

Prompt injection gets the most attention, and it deserves it. Language models follow instructions written in plain language, and they cannot reliably separate the instructions their owner gave from instructions buried in an email, web page or document they were asked to read. Picture a capable new starter who obeys any instruction written on any piece of paper that crosses their desk. A hostile PDF does not need to break into anything. It only needs to ask nicely. The guidance describes this as a persistent and difficult problem, and filtering inputs reduces the risk without removing it. Protection therefore has to come from limiting what the agent is able to do, not from hoping it will not be fooled.

The broader message is refreshingly practical. There is no brand new security discipline to learn. The agencies point organisations back to least privilege, zero trust and layered defences, applied to a new kind of user. They recommend starting with lower-risk tasks and widening the agent’s autonomy only as controls mature, keeping a person in the loop for high-impact or irreversible actions, and planning on the assumption that agents will sometimes behave unexpectedly, which means favouring resilience and the ability to reverse a mistake over raw speed. Parts of the document are written with large organisations and government in mind, but the logic holds for any business that lets software act on its behalf.

Seven questions to put to your IT provider

1. What exactly can the agent reach? A good answer is a specific list of mailboxes, sites and systems, with a reason for each. A weak answer is “whatever the user can see”. In our experience the agent rarely creates a permissions problem. It finds the one that was already there. A SharePoint site that half the company can read was always a risk. An agent that can search it in half a second simply makes the risk visible.

2. Whose identity is it using? Ideally the agent has its own identity, separate from any person, so its activity can be tracked and its access switched off without disrupting a human. The common shortcut is letting it borrow someone’s login or share a service account (a login that belongs to a system rather than a person). It is the digital equivalent of the intern signing documents with the managing director’s name. Convenient, right up until someone asks who actually approved it.

3. What happens when it reads something hostile? Nobody can promise an agent will never be fooled. A good provider talks about containment: limiting what a fooled agent could do, keeping the step where it reads separate from the step where it acts, and putting an approval gate in front of anything consequential. “The vendor takes care of that” is not an answer.

4. Which actions need a person to approve them? Sending something outside the business, deleting data, changing who has access and moving money are obvious candidates. The point is that humans decide where those lines sit when the system is designed, rather than leaving the agent to decide when it needs permission.

5. Can we see what it did, and can we undo it? Every action an agent takes should leave a record, including what triggered it. Reversibility matters as much as visibility. If the answer to “how do we roll this back?” is a long pause, the agent is not ready for important work.

6. Where does our data go? Agents often call on other services to get a job done. Ask which services see your information, under what terms, and whether the licensing you hold actually covers that use.

7. Who owns it when something goes wrong? An agent needs a named owner inside the business, and your incident response process should already cover what happens when the thing misbehaving is software acting on your behalf.

So, is it safe?

Safe is a property of the setup, not of the technology. An agent with a narrow job, its own identity, human approval on sensitive actions, full logging and a way to roll back is a reasonable thing to run. An agent with broad access, a borrowed login and nobody watching is not, however good the underlying model is. Think of it as probation. Even the best new starter does not get the master key on day one.

We are firmly pro-AI, and agents will become an ordinary part of how work gets done. The staged approach in the guidance is simply how that happens without an unpleasant surprise. Start with tasks that are low risk and easy to reverse, such as drafting, summarising and internal search, and let the agent earn more autonomy as the evidence builds.

Where Affinity MSP fits in

We treat agent adoption as an identity, access and data question first, and an AI question second. For a business considering agents, that means mapping what the agent would be able to reach and tightening those permissions before it goes live, giving it its own identity rather than a borrowed login, agreeing which actions need a person’s approval, and rolling it out in stages from low-risk work. It sits on the same foundations as the Essential Eight, which is why we usually find the businesses best placed for agents are the ones that have already done the unglamorous work on access and device security.

If you would like a baseline before the conversation, AffinityScan is a free, domain-based assessment that shows where your external security stands today. If you are already weighing up an agent rollout, our team can walk through these seven questions with you as part of managed IT or alongside your own team through co-managed IT.

FAQ

What is an AI agent?
An AI agent is software that uses a language model to plan and carry out tasks on its own, using the tools and data connected to it, rather than just answering questions.

Is it safe to let an AI agent access company data?
It can be, when the agent has narrow access, its own identity, human approval for high-impact actions, logging and a way to undo mistakes. It is not safe by default, and the risk rises with every extra permission.

What is prompt injection?
Prompt injection is when an attacker hides instructions inside content an agent reads, such as an email or document, so the agent follows them as though its owner had written them. Government guidance describes it as one of the hardest agent risks to eliminate.

Has Australia published guidance on AI agents?
Yes. ASD’s ACSC published Careful Adoption of Agentic AI Services on 1 May 2026, together with CISA, the NSA and the cyber agencies of Canada, New Zealand and the United Kingdom.

How does Affinity MSP help with AI agent security?
We review what an agent could access before it is switched on, tighten permissions and identity, define which actions need human approval, and stage the rollout from low-risk tasks. Our approach is built on the same access and device controls as the Essential Eight, so agents are managed as part of your wider IT environment rather than as a separate experiment.