Questions a CISO should ask before giving an AI agent access to sensitive data or business systems

The questions, by domain

Identity and access

• Does the agent have its own unique, verifiable identity, or does it inherit a human's session?
• Are its permissions scoped to the minimum its task requires? What reviews that scope over time?
• Which actions can it take without human confirmation, and who decided that list?

Data protection

• What categories of sensitive data can it reach, and is masking or redaction applied before data reaches the model?
• Where is data processed and stored, and does that meet your residency obligations?
• Can the agent's access to one data category be revoked independently of other users and services?

Accountability

• For any action the agent takes, can you show which user authorized it and which identity executed it?
• Are tool calls logged with enough detail to reconstruct an incident?
• What is the revocation path, and how fast does it take effect?

Ongoing control

• Is there a policy enforced outside the model itself defining what the agent may do - or does safety depend on the model following instructions?
• Who reviews the agent's permissions, and how often?

A note on process: these questions are designed to slot into your existing access-review and audit routines. They ask for the same kind of evidence those routines already produce, applied to a new kind of actor.