AI Agents in the Workplace: What SMEs Should Approve, Restrict and Audit Before Letting AI Take Action

Artificial intelligence is moving beyond tools that simply generate text, summarise documents or answer questions.

A new generation of AI systems can plan tasks, use business software, access information and take actions on behalf of users.

For an SME, an AI agent could potentially update customer records, prepare support tickets, process documents, generate reports, manage routine workflows or interact with other business systems.

This can create significant productivity opportunities. However, giving an AI system the ability to take action also creates a different level of risk from simply asking a chatbot to draft an email.

Singapore’s Model AI Governance Framework for Agentic AI provides businesses with a practical way to think about these risks. Instead of asking only whether an AI agent works, SMEs should also decide what the agent is allowed to do, what information it can access, when a human must approve its actions and how its activity will be monitored.

1. What is an AI agent?

An AI agent is different from a conventional chatbot or generative AI assistant.

A typical generative AI tool responds when a user provides a prompt. It may draft an email, summarise a document or generate an answer, but the user generally decides what happens next.

Agentic AI can go further.

According to the Infocomm Media Development Authority, or IMDA, agentic AI systems can plan across multiple steps to achieve specified objectives.

An AI agent may therefore be able to:

• retrieve information from company systems;
• use software tools;
• decide what step to perform next;
• update records;
• communicate with customers or employees;
• trigger workflows;
• generate and submit documents; or
• take other actions within the permissions given to it.

The important difference is that the AI is no longer only producing information for a human to review. It may also be acting on that information.

2. Why does agentic AI create a different business risk?

The consequences of an inaccurate AI response are very different from the consequences of an incorrect AI action.

If an AI assistant drafts an incorrect email, an employee may notice the mistake before sending it.

If an AI agent has permission to send the email itself, update a customer database, approve a workflow or initiate a transaction, the mistake may affect the business before a person notices it.

IMDA highlights examples such as an agent updating customer databases or making payments. Greater autonomy and access to sensitive data or business tools can increase the impact of an unauthorised or erroneous action.

This does not mean SMEs should avoid AI agents. It means they should treat the deployment as a business process with controls, responsibilities and limits rather than giving an AI system unrestricted access simply because the technology is convenient.

3. Start with the use case, not the technology

An SME considering agentic AI should begin by identifying a specific business problem.

For example:

• customer support staff spend too much time categorising routine enquiries;
• employees manually copy information between several systems;
• management reports take several hours to assemble each week;
• sales staff repeatedly create similar quotations;
• finance teams spend time matching straightforward documents; or
• employees perform repetitive administrative actions that follow predictable rules.

The business can then ask whether an AI agent is an appropriate way to improve that process.

This is preferable to purchasing an agentic AI product first and then searching for tasks to automate simply because the technology is available.

4. Decide what the AI agent is allowed to access

One of the most important governance decisions is determining which information and systems an AI agent can access.

An agent used for customer support may need access to product information and selected customer records.

That does not automatically mean it should also have access to payroll information, confidential management files, banking systems or the entire customer database.

IMDA recommends bounding risk by limiting an agent’s autonomy and its access to tools and data.

For SMEs, a useful principle is to provide only the access required for the agent to perform its intended role.

If an AI agent only needs to read customer order information, it may not need permission to edit or delete those records.

If an agent prepares payment information for review, it may not need authority to release the payment itself.

5. Separate “read”, “prepare” and “execute” permissions

SMEs can reduce risk by separating different levels of authority.

For example, an AI agent could be allowed to read invoice information without changing it.

A higher level of access could allow the agent to prepare a proposed transaction or draft an update.

A still higher level could allow the agent to execute the action directly.

These three levels create very different risk profiles:

• Read: the agent can retrieve information but cannot change it.
• Prepare: the agent can create a proposed action for a person to review.
• Execute: the agent can perform the action in a live business system.

An SME does not need to give an AI agent execution authority simply because the software supports it.

Starting with read-only or prepare-for-approval access can allow the business to test whether the agent performs reliably before granting greater autonomy.

6. Identify actions that should always require human approval

IMDA recommends establishing significant checkpoints where human approval is required.

For an SME, the appropriate checkpoints will depend on the financial, operational and reputational consequences of the action.

Actions that may justify human approval include:

• making or releasing payments;
• changing bank account details;
• issuing large refunds;
• creating purchase orders above a specified value;
• offering unusually large discounts;
• deleting business records;
• changing customer account permissions;
• exporting sensitive information;
• sending legally significant communications;
• changing employee access rights; and
• taking actions that cannot easily be reversed.

The goal is not to require approval for every small action.

If employees need to approve every step manually, much of the efficiency benefit of automation disappears.

Instead, SMEs should identify the points where the potential impact is large enough that human judgement remains necessary.

7. Financial thresholds can create practical approval boundaries

Businesses can use financial thresholds to determine when an AI agent must stop and request approval.

For example, an SME could configure an AI purchasing agent to:

• prepare purchase orders below S$500 automatically;
• require manager approval between S$500 and S$2,000; and
• require senior management approval for amounts above S$2,000.

The appropriate limits will vary significantly between businesses.

A S$2,000 transaction may be routine for one company but material for another.

The important point is that management defines the limits intentionally rather than allowing the AI agent to decide how much authority it should have.

8. Human approval should be meaningful

Adding an approval button does not automatically create effective human oversight.

Employees may gradually begin approving AI recommendations without reviewing them carefully, particularly if the system has produced correct results many times in the past.

This is sometimes described as automation bias.

IMDA’s framework specifically highlights the need to guard against excessive reliance on automated systems and recommends that organisations regularly assess whether human approvals remain effective.

An approval screen should therefore provide enough information for an employee to make a genuine decision.

For example, instead of simply displaying “Approve transaction?”, the system could show:

• the transaction amount;
• the customer or supplier involved;
• the source information used by the agent;
• the reason for the proposed action;
• any unusual conditions detected; and
• the consequences of approving the action.

This gives the employee a better basis for deciding whether the AI’s proposed action makes sense.

9. Keep a record of what the AI agent did

Businesses should be able to understand what actions an AI agent has taken.

Without useful records, investigating an incorrect action can become difficult.

An audit trail may record information such as:

• what task the agent was asked to perform;
• which systems or tools it accessed;
• what information it used;
• what action it proposed;
• whether human approval was required;
• who approved the action;
• what action was ultimately executed;
• when the action occurred; and
• whether an error or exception was detected.

The appropriate level of logging will depend on the system and the sensitivity of the workflow.

However, actions involving money, sensitive data or important business records generally deserve stronger traceability than low-risk administrative tasks.

10. Test the agent before giving it live authority

IMDA recommends testing agentic systems for baseline safety and security before deployment.

For SMEs, this can include testing the agent using realistic but controlled scenarios before allowing it to operate freely in production systems.

The business should test normal situations as well as unusual ones.

For example:

• What happens if information is missing?
• What happens if two records conflict?
• What happens if a customer asks for something outside company policy?
• What happens if the agent cannot access one of its tools?
• What happens if the requested transaction exceeds an approval limit?
• What happens if an instruction is ambiguous?
• What happens if the agent receives malicious or misleading content?

A system that performs well during ideal demonstrations may behave differently when exposed to messy real-world business data.

11. Consider a limited rollout before full deployment

IMDA recommends gradual deployment rather than immediately giving an AI agent full access across an organisation.

An SME could begin with a limited group of employees, a small customer segment or a restricted set of functions.

Another option is to operate the agent in a review-only mode.

For example, the agent could generate the action it would have taken without actually executing it.

Employees can then compare the proposed actions with what they would have done manually.

If the agent consistently performs well, the business can gradually increase its responsibilities.

If problems appear, management can correct them before the system affects a larger part of the business.

12. Example: an AI agent handling customer support

Consider an SME that receives hundreds of customer support enquiries each week.

The company introduces an AI agent that can read incoming requests, search customer records, create support tickets and prepare responses.

A low-risk version of the workflow could allow the agent to:

• classify incoming enquiries;
• retrieve relevant customer information;
• create a support ticket;
• suggest a priority level; and
• draft a response for an employee to review.

The business may decide that the agent cannot:

• delete customer records;
• export the entire customer database;
• change account ownership;
• issue large refunds;
• change payment information; or
• send sensitive communications without approval.

This allows the SME to benefit from automation without giving the agent unnecessary authority.

13. Example: an AI agent working with invoices and payments

The financial risk becomes more significant when an AI agent interacts with accounting or payment processes.

Consider an agent designed to process supplier invoices.

The agent could:

• read an invoice;
• identify the supplier;
• compare it with a purchase order;
• check whether the amount matches;
• prepare the accounting entry; and
• send the transaction to a finance employee for approval.

This provides substantial automation without giving the AI authority to transfer money.

The SME may decide that payment release always requires a human employee, or perhaps two employees for transactions above a specified threshold.

This preserves an important financial control while still reducing repetitive administrative work.

14. Pay particular attention to changes in payment information

Changes to supplier bank account details deserve especially strong controls.

An SME should be cautious about allowing an AI agent to receive an email claiming that a supplier has changed its bank account and then automatically update the payment record.

A safer workflow may require an employee to independently verify the change through an established contact method before the banking information is updated.

The AI agent may assist by identifying the requested change and preparing the record, but the final approval remains with an authorised person.

This is an example of matching the level of human oversight to the potential financial impact of the action.

15. Third-party AI agents still require governance

An SME does not need to develop its own AI agent for these considerations to apply.

Many businesses will adopt agentic capabilities through third-party software providers.

IMDA’s framework is intended for organisations using both internally developed agents and third-party agentic solutions.

Before connecting a third-party agent to important systems, SMEs should understand:

• what data the agent can access;
• which actions it can perform;
• what permissions the software requires;
• how activity is logged;
• whether access can be restricted;
• what approval controls are available;
• how incidents are handled;
• how the provider protects information; and
• what happens if the service becomes unavailable.

The convenience of connecting an AI product to existing business software should not replace proper vendor and risk assessment.

16. Personal data still requires careful handling

AI agents may process customer, employee or other personal information while carrying out business tasks.

For example, a customer service agent may access names, contact details, transaction histories or support records.

An HR-related agent may interact with employee information.

SMEs should therefore consider what personal data the system genuinely needs and avoid giving an agent unrestricted access merely for convenience.

Existing obligations under Singapore’s Personal Data Protection Act should also form part of the organisation’s wider assessment where personal data is involved.

The business should understand where data is sent, how it is processed, who can access it and whether the selected AI provider is appropriate for the information involved.

17. Cybersecurity becomes more important when AI can use tools

The Cyber Security Agency of Singapore has highlighted that agentic AI can understand context, formulate plans and take independent actions while accessing tools and data.

These capabilities can increase the potential impact of a security failure.

For example, compromising a conventional chatbot may expose information or generate misleading output.

Compromising an agent with access to business tools could potentially allow unauthorised actions to occur through those tools.

Businesses should therefore treat the security of connected systems, accounts and permissions as part of the AI deployment rather than viewing the agent as an isolated application.

CSA’s guidance on securing agentic AI recommends assessing agentic workflows to identify where vulnerabilities could be exploited and implementing controls throughout the system lifecycle.

18. Employees need to understand what the agent can and cannot do

IMDA identifies end-user education as an important part of responsible agentic AI deployment.

Employees using an AI agent should understand:

• what tasks the agent is authorised to perform;
• what information it can access;
• when human approval is required;
• what types of decisions should not be delegated;
• how to report unexpected behaviour;
• how to stop or override an action where necessary; and
• who remains responsible for the business process.

Employees should also retain the underlying skills required to evaluate important AI outputs rather than becoming completely dependent on automation.

This becomes particularly important when the AI system has performed reliably for a long period and users begin to trust it automatically.

19. Assign a human owner for each important AI agent

An SME should know who is responsible for each significant AI deployment.

The responsible person does not necessarily need to be an AI engineer.

However, someone should be accountable for understanding the business process, reviewing performance and ensuring that appropriate controls remain in place.

Responsibilities may include:

• approving the agent’s intended use;
• reviewing its permissions;
• monitoring incidents and errors;
• checking whether approval thresholds remain appropriate;
• reviewing audit records;
• coordinating with the technology provider; and
• deciding when the agent should be restricted, updated or disabled.

This helps prevent a situation where an AI agent becomes embedded in daily operations but nobody clearly owns the risk associated with it.

20. Measure whether the AI agent is actually creating value

Governance should not focus only on avoiding problems.

An SME should also determine whether the agent is generating enough business value to justify its cost and complexity.

Useful measures could include:

• hours of employee time saved;
• reduction in processing time;
• reduction in manual errors;
• number of tasks completed successfully;
• percentage of actions requiring human correction;
• customer response times;
• cost per transaction;
• software and AI usage costs; and
• incidents caused or prevented.

An AI agent that saves five hours of work each month but requires expensive subscriptions, frequent corrections and extensive oversight may not provide the expected return.

Conversely, an agent handling a high-volume repetitive process reliably may create meaningful productivity gains even if humans continue approving important actions.

21. Review controls as the agent becomes more capable

AI systems and business processes change over time.

An agent that initially performs one narrow task may later be connected to additional data sources or business tools.

Each additional capability may change the risk profile.

For example, allowing a customer support agent to read order information is different from later giving the same agent permission to issue refunds.

Businesses should therefore review governance when:

• a new tool is connected;
• the agent receives additional permissions;
• the agent gains access to new categories of data;
• financial limits are increased;
• a new AI model is introduced;
• the vendor materially changes the service;
• the workflow becomes more autonomous; or
• the agent begins interacting with other AI agents.

A control structure that was appropriate for the original deployment may no longer be sufficient after the system expands.

22. A practical checklist before giving an AI agent authority

Before allowing an AI agent to take actions inside the business, an SME can ask:

• What exact business problem is the agent solving?
• What data does it genuinely need?
• Which systems and tools can it access?
• Can its permissions be reduced?
• Which actions can it perform automatically?
• Which actions require human approval?
• Are financial approval limits defined?
• Can important actions be reversed?
• Are actions logged clearly?
• Has the system been tested using unusual and failure scenarios?
• Can the agent be stopped quickly if something goes wrong?
• Do employees understand how to supervise it?
• Who is accountable for the deployment?
• How will performance and incidents be reviewed?
• Is the productivity benefit worth the financial and operational cost?

23. SMEs do not need maximum autonomy to benefit from AI

One of the most useful principles for SMEs is that AI automation does not have to be all or nothing.

An AI system can still create substantial value while operating within carefully defined boundaries.

For example, an agent may research information, prepare documents, identify exceptions and recommend actions while leaving high-impact decisions to employees.

As confidence grows, selected low-risk activities can gradually become more automated.

This approach allows the business to capture productivity benefits without immediately giving a new system unrestricted authority over important operations.

Final thoughts

AI agents can potentially save SMEs significant time by moving beyond content generation and helping to carry out real business processes.

However, the ability to take action also means that mistakes, security failures and poor instructions can have direct operational or financial consequences.

Singapore’s Model AI Governance Framework for Agentic AI provides a useful starting point. Businesses should assess risks before deployment, limit an agent’s autonomy and access, establish meaningful human approvals, implement technical controls, monitor performance and ensure that people remain accountable.

For SMEs, the objective should not be to give an AI agent as much independence as possible.

The better question is how much autonomy is actually necessary to achieve the business benefit.

By starting with narrow permissions, clear approval thresholds and strong audit trails, SMEs can explore agentic AI while keeping important business decisions, sensitive information and financial actions under appropriate control.