The question every firm asks is what can the AI see.

The question every firm asks is what can the AI see. The question that matters is what can it touch.

Most AI rollouts start read only. An agent answers questions, summarizes a document, drafts an email for review. Low risk, because nothing changes until a human approves it. Then the pilot goes well, and the natural next step is write access, letting the agent update a CRM record or send a message without someone checking first. This is where the risk profile changes, and most firms do not treat it that way.

A read only agent that gets something wrong produces a bad answer someone has to catch. A write enabled agent that gets something wrong writes that answer into the system of record, where the next person or agent treats it as fact. A wrong account balance in a chat response is an inconvenience. The same number in a CRM field becomes the basis for a client conversation or a compliance filing.

The firms handling this well are not running the most capable agents. They built permissioning as granular as the actions themselves. An agent can read a document vault but not write to it. It can draft a task but not close one. Access maps to a role, tied to identity, the same way a junior analyst has different permissions than a partner. Too permissive, and one bad output propagates before anyone notices. Too restrictive, and the agent cannot do enough to justify deploying it.

Most firms’ existing access controls were built for people, not for agents that can take hundreds of actions a minute without hesitating before hitting submit. Permissioning has to live at the identity layer, not get bolted onto each tool separately, or a firm ends up managing access rules in five places with no single view of what any agent is actually authorized to do.

This is the structural work LEA does before a firm hands any agent write access to a live system: role based permissioning tied to Entra ID, scoped to exactly what each agent needs and nothing more. An agent that can only see is a pilot. One that can safely act is an operating decision, and it depends on getting this layer right first.