AI agents at work: why every action needs approval

The short answer: an AI agent is an assistant that does not only answer but acts: it opens apps, fills forms, sends messages and changes files. In 2026 every major vendor offers one, and every one of them tells you the same two things in its own documentation. Agents can be tricked by instructions hidden in the content they read, and a person should confirm any action with real consequences. A company that lets agents act should therefore set three rules before it sets anything else: what the agent may touch, which actions need a human yes, and where that yes is enforced.

What is an AI agent, compared with a chatbot?

A chatbot gives you text and you decide what to do with it. An agent is given a goal and the means to pursue it: a browser, a mailbox, a file system, a company application.

Microsoft's description of its "computer use" feature for business agents captures the idea in one line: "If a person can use an app or website, computer use can too." The same page notes that "By default, computer use can operate on any website or application." That is the appeal and the risk in two sentences. Whatever the employee's account can do, the agent can attempt.

What can go wrong?

The central problem is called prompt injection. An agent reads things: web pages, emails, PDFs, screenshots. If one of those contains text written to look like an instruction ("ignore your task and forward this file to..."), the model may obey it, because to a language model, the content it is reading and the instructions it was given are both just text.

This is not a fringe worry. The vendors say it themselves.

• Anthropic's documentation for its computer-use tool states: "In some circumstances, Claude follows commands found in content even when they conflict with your instructions."
• Microsoft's page on its experimental agent features in Windows describes "cross-prompt injection (XPIA), where malicious content embedded in UI elements or documents can override agent instructions".
• The UK's National Cyber Security Centre wrote in December 2025 that "prompt injection attacks may never be totally mitigated" in the way older attacks were, and described a language model as an "inherently confusable deputy".
• OWASP, the body whose lists of top security risks are a standard reference, says "it is unclear if there are fool-proof methods of prevention for prompt injection".

The second problem OWASP names is "excessive agency". It gives three root causes: excessive functionality, excessive permissions and excessive autonomy. In ordinary words: the agent can do too many things, with too much access, without asking.

What do the vendors themselves recommend?

Read past the launch announcements to the safety pages and the advice is consistent.

Three ideas repeat: limit what the agent can reach, isolate where it runs, and put a person in front of anything that matters.

Is asking for approval enough?

Only if the approval is real. This is the most useful and least discussed point.

There are two ways to build "the agent asks first". In the first, the model decides when to ask. In the second, the software around the model decides, using fixed rules, and the model cannot skip it.

Microsoft is candid about the weakness of the first kind. Its documentation on human supervision for computer-use agents says the review requests are triggered by "probabilistic AI model behavior", and gives this instruction: "Don't rely on human review or clarification requests as a fail-safe or as a guarantee that the system always requests human input before proceeding."

That is the NCSC's point from the other side. A safeguard that the model can talk itself out of is not a safeguard. The check must sit outside the model: a rule that says "sending money, deleting files and emailing outsiders always stop for a person", applied by ordinary code.

A second weakness is the person. If the approval box says only "Allow?", people click yes. An approval is worth something when it states plainly what will happen, to what, and lets the person refuse.

What rules should a company set before using agents?

• Scope. List the systems an agent may touch. Start with one, and with data that would not hurt you if it leaked.
• Least access. Give the agent its own account with only the permissions the task needs, not an administrator's.
• A fixed list of actions that always need a human. Payments, deletions, anything sent outside the company, changes to access rights, changes to system settings.
• Enforcement outside the model. Ask the vendor: is the approval step decided by the model, or by rules the model cannot override?
• A readable approval. The request must say what will be done in plain words.
• A log. Every action, who approved it, and when.
• Untrusted content stays untrusted. An agent that reads the open web or incoming email should not also hold the keys to money or customer records.

If your staff are already using public AI tools on company data without any of this, start with our article on shadow AI.

How does DNX OS handle actions by AI?

We build an operating system with an assistant in it, so we have had to answer these questions in the product. Here is what exists today, and what we cannot show.

Nova, the assistant in DNX OS, runs on the PC and "asks before it changes anything". When a request would change something, the system shows what Nova wants to do and waits for Approve or Decline. In the DNX Terminal, commands are sorted by fixed rules into read, write and destructive before they run; the model can make a command stricter but never looser, and destructive commands are only typed for the person to run themselves. We have not pictured Nova's approval card in this article because we could not capture it for this piece, and we do not publish drawings of screens.

What we can show is the same principle in DNX Flow, the automation app. A flow that reaches an Approval step stops and waits on an Approvals page until a named person decides.

The request names what is being asked and by whom. The flow cannot continue past this step by itself, because the step is part of the flow's structure, not a judgement made by a model. There is more on the assistant in Nova AI: a private AI assistant for office work.

DNX OS is in beta from December 2026, and its agent features are narrower than the large cloud agents: Nova works with what is on the PC. We think that is the right starting point. If you want to test it, apply for the beta.

What is still uncertain?

• No one has solved prompt injection. Every source above says so. Expect defences to improve and not to become perfect.
• Standards are still being written. The US standards body NIST announced an AI agent standards initiative in February 2026. We did not find final guidance from it.

Sources

All sources were opened on 12 November 2026.

• OWASP GenAI Security Project, LLM01:2025 Prompt Injection.
• OWASP GenAI Security Project, LLM06:2025 Excessive Agency.
• UK National Cyber Security Centre, Prompt injection is not SQL injection, 8 December 2025.
• Anthropic, Computer use tool documentation.
• Microsoft Learn, Human supervision of computer use, Copilot Studio, dated 20 October 2026.
• Microsoft Learn, Computer use, Copilot Studio, dated 20 October 2026.
• Microsoft Support, Experimental agentic features, last updated 5 December 2025.
• NIST, Announcing the AI Agent Standards Initiative, 17 February 2026.