How should companies run access reviews for AI agents?

Kaykas-Wolff recommends reviewing what each agent actually did before what it is allowed to do. Pull the last thirty days of actions from the connected systems, compare them with the agent's granted scopes, and narrow or remove anything it has not used. Grants unused for ninety days are removed by default, and the owner can request them back with a reason.

Why do executive accounts create the biggest AI agent access risk?

When an executive connects an assistant agent to their own mailbox or calendar, no new account is created. The agent holds a token inside the executive's account, often with full read and send scope, and the only person who approved it is the executive. Standard access reviews have managers certify their own people, so these high-privilege grants end up with the weakest review.

Who should review a CEO's AI agent grants?

Someone outside the CEO's reporting line. Kaykas-Wolff suggests the CFO at a smaller company, or the audit committee chair at a larger one, reviewing an export of every connected app and token on the CEO's accounts alongside thirty days of activity. Anything the reviewer cannot explain from the log is either justified in writing or removed.

How often should AI agent access be reviewed?

It depends on what the grant allows. Kaykas-Wolff reviews grants that let an agent commit the company, such as sending a quote or issuing a refund, every month, while read-only research access can follow the normal quarterly cycle. Grants that have gone unused for ninety days are removed regardless of the schedule.

What should a board see about AI agent access reviews?

Two counts and one yes-or-no answer: how many agent grants were reviewed this quarter, how many were removed or narrowed, and whether executive delegations were in scope. If removals come back at zero two quarters in a row, Kaykas-Wolff treats the review as a rubber stamp, because agent permissions only grow unless someone deliberately cuts them back.

AI Agent Access Reviews: Start With the CEO's Own Grants

I run Visiting Media with a fleet of specialized agents doing a real share of my content and research work, plus a fair amount of operations. That fleet started as automation I built for myself, on my own accounts. Every connection began with a consent screen. I was the person clicking Allow.

Every company with an auditor already runs a quarterly user access review. A manager gets a list of who can reach the finance system, confirms each name still belongs there, and signs. It is tedious and it mostly works. When I went looking for how that review should extend to agents, I found plenty of good material, and all of it pointed at the wrong end of the org chart.

What the access review guides agree on

The pages that rank for this are mostly written by identity and security vendors, and they make the same core arguments. Agents are non-human identities, and the quarterly review was built for people who join a company and eventually leave it. A list of entitlements shows what an agent was granted, which says little about what it actually does with them. Agents change faster than a quarter (a new model version, or a prompt someone edited on a Tuesday), so a snapshot goes stale before anyone signs it. Every agent needs a named owner. Most of the guides end by recommending continuous monitoring, usually the kind the author happens to sell.

I agree with almost all of it. The ownership point especially. It is the same rule I hold in my own delegation of authority matrix for agents, where a team is never an owner.

What the guides picture, though, is a service account an engineer created for a pipeline. That account shows up in the identity system, it has a name, and an inventory tool can find it.

The grants nobody inventories

A delegated grant looks different. When an executive connects an assistant agent to their mailbox, no new account appears anywhere. What exists is a token inside the executive’s own account, listed (if anyone ever looks) on a connected-apps page in an admin console, and it carries whatever scope the executive accepted on a screen they read for about two seconds. Often that scope is full read and send. The agent can now do anything the executive can do in that system, at three in the morning, at volume, under the executive’s name.

Now run the normal review against it. The access review asks each manager to certify their people’s access. The executive’s access gets certified by the executive, or by an IT lead who reports, eventually, to the executive. Neither is going to revoke the CEO’s assistant agent on a Thursday afternoon.

So the highest-privilege agents in the company end up with the weakest review. They read board materials and acquisition threads. They see the compensation spreadsheet. And their approval chain is one person long.

I am describing my own setup here, at least as it was before I cleaned it up.

Review what it did before what it can do

The vendor guides are right that entitlements make a poor proxy. My version of the fix is cheap and needs no new software. For each agent, pull its last thirty days of actions from whatever logs the connected systems keep, and lay them next to its granted scopes. The useful output is the difference between the two columns. An agent with send rights that has only ever drafted gets narrowed to drafting. One that holds write access to a site it last touched in the spring loses it, the same afternoon.

Anything unused for ninety days goes, with no discussion, and the owner can ask for it back with a reason. I learned the hard way that “we stopped using it” and “it stopped running” can sit months apart, which is most of what retiring an AI agent turned out to be about. Stale grants are the same failure caught earlier.

Then sort what survives by the tiers in the delegation matrix. A grant that lets an agent commit the company, say by sending a quote or issuing a refund, gets reviewed monthly. Read-only research access can wait for the quarter.

Hand your own grants to someone else

Give yours to the CFO.

The mechanics are simple. Once a quarter, the CEO exports every connected app and token on their own accounts, plus every agent that acts under their name, and the CFO goes through the list with the thirty-day activity next to it. Anything the CFO cannot explain from the log, the CEO either justifies in writing or removes. Expect the first session to be mildly embarrassing. Trial tools from a year ago keep their tokens long after anyone remembers signing up.

At a larger company I would give the CEO’s list to the audit committee chair instead, and send the CFO’s own grants to the CEO. The rule is that nobody signs off on themselves or on anyone above them. The same pairing works for the rest of the executive team. Assistants with delegated access to executive inboxes, human or agent, belong on it too.

A review that never removes anything

Track one number from every cycle: grants removed or narrowed. If it comes back zero two quarters in a row, the review has become a signature, and I would assume the process is broken, because agent permissions only ratchet upward unless someone pushes them down on purpose. The ninety-day rule is there to keep that number above zero.

What the board should see

Directors do not need the token list. I sit on the board of ACT | The App Association, and the AI questions I find useful in that room are the ones management can answer with a count. Here the counts are grants reviewed this quarter and grants removed. Then one yes or no: were executive delegations in scope? A no tells the board the review skipped the accounts that matter most.

That fits naturally next to the accountability and concentration items in what boards should ask about AI, and a company with an AI risk appetite statement can add a line for it: zero agents acting on executive accounts without a reviewer outside that executive’s reporting line. It is also the first thing a successor will need on day one, which I wrote about in CEO succession when the CEO runs the fleet.

Where to start this week

Open the connected-apps page on your own email account. Count what is there, and write down which of those you could explain to your CFO without opening the app first. I would bet on finding at least one you forgot. Remove it, then put the quarterly review with someone outside your reporting line on the calendar before the end of the month. The shadow agents your employees built deserve an amnesty. Yours deserve an auditor.

This article is part of the Executive Leadership cluster, focused on board governance and the operating discipline required to run AI systems responsibly at the executive level.

AI Agent Access Reviews: Start With the CEO’s Own Grants