The short answer: three security review questions for AI agents
A security review of your AI agents comes down to three questions: what exists and who owns it, what each agent can reach as opposed to who can use it, and when it was last reviewed and whether you can show the evidence. A number is not an answer to any of them; a specific answer with specific limits is.
- What exists, and who owns it?
- What can it reach, as opposed to who can use it?
- When was that last reviewed, and can you show me?
What exists, and who owns it?
What they are really asking. Whether anyone is accountable. Not whether the technology is safe in principle, which is a question nobody can answer, but whether a named person is responsible for each thing running in your environment.
The answer that fails is a number. Telling a reviewer there are roughly two hundred agents tells them you have counted, which is not the same as knowing. The follow-up is always the same: who owns that one, and is that person still here?
An agent whose creator has left the company is one of the most common findings, and the one that moves a review from routine to uncomfortable.
A good answer names the population, says which of them have an active owner, and is honest about the part that is not yet covered. Reviewers are used to incomplete answers. They are not used to confident ones that turn out to be wrong.
What can it reach, as opposed to who can use it?
Who can use an agent is a sharing decision somebody made on purpose. What an agent can reach is inherited from the permissions of whoever built it, and nobody decided that at all. A maker with broad access across the estate builds an agent with that same breadth, and everyone who then uses it is effectively asking questions through their colleague's permissions.
A reviewer who understands this will not ask it in those words. They will ask something like: if I use the finance assistant, what can it see on my behalf? If the answer is a description of who the assistant was shared with, you have answered a different question, and a good reviewer will notice.
The preparation here is simple and worth doing once. Pick the agent sitting closest to sensitive content, trace what it can reach, and have that example ready. One traced agent is a better answer than a policy document.
When was that last reviewed, and can you show me?
What they are really asking. The third question separates a governance position from a cleanup that happened once. Reviewers ask it because they know the first two answers decay. An inventory built in March is a historical document by September.
Two parts to this, and the second is the one that catches people. The first is whether a review happens at all: a named person, a set frequency, in a calendar rather than understood. The second is whether you can produce the evidence of it without starting a project.
If producing evidence takes three weeks of assembling screenshots, then your audit timetable is set by whoever asks rather than by you. That is a worse position than having no evidence, because it is discovered late.
Oversharing and data loss top the list of blockers
-
51%
of IT leaders name oversharing and data loss as the top barrier to a successful Copilot deployment.
What a weak answer sounds like
All three questions have the same failing answer, and it is worth recognizing because it feels reasonable when you say it. It sounds like: we would have to look into that.
That answer is honest and it is also the one that turns a review into a project. It tells the reviewer that the controls they are assessing may exist and nobody can currently demonstrate them, which is the condition they are trained to escalate.
The alternative is not having perfect answers. It is having specific ones, including specific limits. A team that can say we have the authored agents covered, here is the owner list, here is what we have not solved yet and here is when we are looking at it, comes out of a review in a stronger position than one that answers everything vaguely.
Rehearse it before someone else runs it
Take the three questions to your own team first and answer them honestly, in a room where being wrong costs nothing. Most teams discover the same thing: the first question is answerable with effort, the second has never been asked in those terms, and the third has no owner. That is a useful hour, and it is considerably cheaper than finding out in front of a reviewer.
Frequently asked questions
What will a security review ask about AI agents?
What is a weak answer to an AI agent security question?
Why is "who can use it" not the same as "what can it reach"?
How do we rehearse a security review?
How can Rencore help with the evidence?
Where this fits in Rencore Governance
AI & Agents module
One inventory of every Copilot Studio agent and every site that holds SharePoint agents, with owner, reach and policy.
See the AI & Agents moduleEU AI Act evidence for agents
Per-agent evidence for risk classification and audits, produced on demand.
See the solutionCopilot and agent governance
Find agents without an owner, see what each one can reach and enforce policies on a schedule.
See Copilot governance