Main

BTU researchers’ analytical assessment is that useful AI autonomy depends on precisely chosen permissions sufficient to complete a defined task. For Georgian organizations, the practical challenge is to distinguish access to information, preparation of work and execution of actions, then authorize each according to need.

Key Takeaways

• BTU’s synthesis of agentic management research proposes task completion within defined boundaries as the practical test of an AI agent’s permissions in a Georgian organization.
• Reading information, preparing a reply and sending that reply to a customer are separate actions; permission for one action does not automatically authorize the others.
• BTU researchers assess that Georgian companies can delegate recurring work when the relevant data, action, recipient, duration and human stopping mechanism are established in advance.

A Georgian business manager asks an agent to check orders and answer customers’ questions. The request sounds straightforward. Yet it involves different capabilities: opening an order record, finding delivery information, composing a response and sending a message. If the agent can only perform the first step, part of the job remains with a person. If the agent has unrestricted access, a single service task may open up many unrelated organizational actions.

The permissions question sits between these outcomes. A company needs an agent that completes useful work independently within an understandable operating space. Asking how intelligent the model is does not settle that question. A more practical question is what the agent can actually change on the organization’s behalf. The answer helps determine whether daily use becomes meaningful assistance or another activity requiring constant supervision.

BTU’s agentic management research links decision rights to the consequences of actions, the sensitivity of information and human responsibility. Combining that framework with technical practice produces the central finding: permissions should attach to a complete task and specific actions. A broad job-like label such as “sales agent” cannot by itself determine what the system should be allowed to do. 

From reading to acting

Access to information is the first layer. A customer-service agent may need an order number, the product and its delivery status. The purchase history of every customer is not necessarily needed to answer that particular question. A knowledge agent may need approved service terms, opening hours and public prices. Access to employees’ personnel records would not improve its performance on the same task.

Access and disclosure must also be distinguished. An agent may legitimately view an internal record while using only the permitted portion in a customer response. An employee’s internal comment about a possible delivery delay, for example, may still require verification. Visibility does not turn a record into the company’s official statement. The working environment therefore needs to distinguish internal information from material approved for external use.

Preparation is the next layer. An agent drafts a message, summarizes information, develops possible responses or fills in a working document. The organization receives a substantial part of the work before an external commitment is made. Preparation rights are especially useful when testing a new process: a person can see how the agent understands the assignment while retaining control over the final action.

Execution is a further layer. Sending a message, creating a reservation or updating an operational record changes the environment. The agent should have permission to do so when the boundaries are clear. Who receives the message? Which record can change? Which conditions have already been approved? Answers to these questions convert a general instruction into usable authorization. The ability to write and the permission to send should be considered separately.

Anthropic’s technical account of trustworthy agents illustrates this distinction through calendar access: reading a calendar and sending an invitation can require different permissions. Its explanation connects user control to tool selection and conditions placed on actions. Although this describes a particular product approach, the management lesson is broader: establishing a connection does not itself determine which actions are authorized.

Minimum access should still enable complete work

Security engineering uses the principle of least privilege: a system receives the access needed for its function. OWASP’s MCP security guidance similarly emphasizes narrowly scoped permissions and controls over individual tools. For a business, the implication is to give an agent capabilities connected to its assignment rather than an employee’s entire digital environment.

Minimum should not mean insufficient. An agent that stops at every step because it cannot see a necessary document may look formally constrained while being unable to complete the task independently. BTU researchers assess that good permission design starts with the complete path of the work. What information is needed, where is the result produced and at what point does the process affect another person or organization?

Consider an illustrative Georgian education provider’s information agent. Approved program descriptions, tuition information and an admissions calendar can support answers to recurring questions. If the organization also authorizes sending those answers through the relevant channel, the agent can complete the information service. It does not need access to students’ grades or employees’ compensation to do that job.

The same logic applies to a small retailer. Checking inventory and telling a customer which products are available may be sufficient for an information service. Changing prices is another action requiring separate conditions. Narrow permissions preserve a practical role for the agent: a useful process can be completed without delegating control over the entire commercial policy.

For Georgia, the value of this approach lies in understanding the local process. Correct Georgian-language interpretation matters, but recognizing an approved price, a current promotion and the applicable service rule involves more than language. An organization needs to know which source is current and who maintains it. Appropriate local information and appropriate permissions jointly create operational capability; neither can compensate for the absence of the other.

Authorization must exist in the system

Clear instructions are essential, but access control cannot remain a sentence in a prompt. If an agent is instructed to use one folder while its connected application exposes an entire repository, the organization largely depends on the model behaving correctly. A more robust arrangement makes only the relevant folder or records technically accessible. The authorized working boundary then becomes part of the environment itself.

Official MCP security guidance discusses restricted environments and access to necessary resources for locally running tools. In management terms, an agent needs a particular workbench with suitable materials and tools. It does not need the keys to the whole office merely to complete one task quickly. The practical implementation depends on the capabilities of the application and integration being used.

The quality of permissions therefore belongs in purchasing decisions. One connector may require broad account access while another separates reading from modification. An organization needs to assess whether its intended boundary can actually be enforced. If a system cannot distinguish actions adequately, preparing drafts may be a more appropriate initial use than executing changes directly.

The circumstances of an action matter alongside the breadth of access. Permission to send customers messages is clearer when the recipient group, message purpose and permissible information are specified. A one-off assignment and recurring work require different durations of authorization. A company may want an agent to distribute approved updates regularly, but only to an agreed audience through a designated channel.

Such clarity can release people from repetitive approvals. Human approval is most valuable when the choice or its potential consequences have changed. Reconsidering an already understood routine action consumes attention. A new recipient, different information or a more significant commitment calls for a fresh assessment. Where that boundary sits is an organizational decision that must fit the system’s security rules and applicable requirements.

Permissions can change

Access granted once is not a permanent decision. Staff, services, customer groups or the agent’s tools may change. An existing permission can become unnecessarily broad or insufficient in the new setting. Permission management therefore cannot be confined to the period before deployment. During operation, the organization needs visibility into the actions being performed and permissions that are no longer needed.

BTU’s framework connects this issue to managing agent operations and preserving human intervention. A company should be able to reduce, suspend or revoke access, with a responsible person and a technical route identified in advance. Stopping an agent cannot necessarily reverse a message already sent or an action completed by another party. Timely interruption of subsequent steps and preservation of the action record are therefore important.

That record also provides a practical basis for trust. If a company can establish what an agent accessed, prepared and changed, investigating a problem becomes more specific. Outdated information can be distinguished from mistaken interpretation or excessive access. Otherwise, every difficulty risks being attributed to a generic model “error,” leaving the organization unsure which component to improve.

Successfully completed assignments can inform a discussion about expanding permissions, but success does not itself create authorization. A new action deserves its own assessment, especially if it involves different information, another recipient or a consequence that is harder to reverse. This is the substance of gradual adoption: the organization uses experience to make decisions and deliberately adjusts the operating boundary.

BTU researchers’ analytical assessment is that a strong agent in a Georgian organization emerges when task completion and permission management are designed together. The agent should be able to obtain the necessary information, prepare a result and complete the authorized action. The company should be able to see and change those boundaries. That relationship supports independence that can genuinely be used in everyday operations.

Questions and answers

Can an agent receive read-only access

Yes, when the task is information retrieval or analysis. Access to sensitive information still needs appropriate boundaries, and permission to read does not authorize external disclosure.

When can an agent send a reply itself

When the organization has authorized the action, recipient, information and conditions, and the technical system enforces those limits. A separate approval route should cover exceptional cases.

Should good results automatically expand permissions

No. Previous performance informs assessment, while the access and consequences associated with a new action must be considered separately.

What does revoking permission mean

Stopping subsequent authorized actions in the relevant system. Revocation does not automatically undo a message already sent or a consequence that has already occurred.