Your AI Agents Need an Approval Rulebook, Not an Approve Button

Your staff are starting to ask AI agents to read company systems, draft work and take actions. Agent platforms ship an approval prompt, and switching it on looks like the governance step. It is not. On 1 May 2026 the Canadian Centre for Cyber Security and five allied agencies (the Australian Signals Directorate, the US Cybersecurity and Infrastructure Security Agency and National Security Agency, and the national cyber security centres of New Zealand and the United Kingdom) published Careful adoption of agentic AI services. Its human-in-the-loop section asks for something a toggle cannot supply: "Ensure decisions about when human approval is required are determined by system designers or operators, not delegated to the agentic AI system" (Australian Signals Directorate et al., 2026, p. 22).

I hold the CISSP, and I have spent 25+ years in technology and security, including Government of Canada cloud security assessments. This piece is for the operator in that sentence: the company that has to write those decisions down.

What the joint guidance actually asks for

The guidance is advice, not law. It is still a specific, public statement of what six national cyber agencies expect from an organization running agents. Four of its recommendations carry the weight for a company starting out.

First, least privilege: "strict adherence to the principle of least privilege is critical", because the privileges an agent holds set the level of risk it can introduce (Australian Signals Directorate et al., 2026, p. 7). Second, approval before impact: agents must not autonomously execute "high impact actions or outputs without prior human approval", with checkpoints where the cost of error is high, such as system resets, network egress or deletion of critical records (p. 22). Third, logs the agent cannot touch: isolate agents "into enclaves with no write access to logs" (p. 20), and quarantine requests to delete logs or audit records until a person has reviewed them (p. 22). Fourth, accountability: assign responsibility for errors or adverse outcomes the system causes (p. 22).

Read those four together and a pattern shows. None of them is a product feature. Each is a decision about your business: which data an agent may see, which actions count as high impact for you, who approves, and who answers when it goes wrong.

Why an approve button is not oversight

It is tempting to read human in the loop as turn on the approval prompt. That reading is the expensive one.

Ben Green surveyed 41 policies that prescribe human oversight of government algorithms and found two flaws. Evidence suggests people are unable to perform the oversight functions those policies assume, and as a result the policies "provide a false sense of security" while letting vendors and agencies avoid accountability (Green, 2022). The mechanism has a name. Under automation bias, people, experts included, "defer to automated systems, reducing the amount of independent scrutiny that they exhibit" (Green, 2022).

Green's sample is government algorithms, not company agents, and I would not stretch his finding further than that. The lesson that does carry over is narrow and practical. A person shown a stream of agent actions with an Approve button and no rule about what to check is in exactly the position automation bias describes. Green's own remedy is to justify each use, and its form of oversight, before adoption (Green, 2022). Inside a company, that justification is a written rulebook.

Five dates that make the rulebook auditable

Four rules and one piece of guidance give a Canadian company that uses AI a dated reason to write this down, depending on where it operates and whom it serves. A fifth rule, Quebec's, is already in force.

Dated rules that reach Canadian companies using AI

1. 1 Jan 2026

   Ontario: disclose AI screening in job postings (25+ employees)

2. 1 May 2026

   Joint guidance on agentic AI (six agencies)

3. 2 Dec 2026

   EU AI Act Art. 50(2): marking deadline for generative systems already on the market

4. 1 May 2027

   OSFI Guideline E-23 in force; AI/ML methods inside the model definition

5. 2 Dec 2027

   EU AI Act: Annex III high-risk duties apply

Quebec. Under Law 25, an organization must inform a person when a decision about them is based exclusively on automated processing of their personal information, no later than when it informs them of the decision, and must let them submit observations to a staff member able to review it (Commission d'accès à l'information du Québec, n.d.). Whether a person's approval takes a decision outside exclusively is a question for your counsel. The rulebook is where you record what that person actually checked.

Ontario. Since 1 January 2026, an employer with 25 or more employees that uses AI "to screen, assess or select applicants" for a publicly advertised posting must say so in the posting, and the duty applies equally when a recruiting firm does the screening (Government of Ontario, 2026). An agent that ranks résumés is in scope, whoever runs it.

The European Union. Providers of generative systems placed on the market before 2 August 2026 must meet the Article 50(2) machine-readable marking duty by 2 December 2026. The high-risk duties for Annex III uses apply from 2 December 2027, moved from 2 August 2026 (European Union, 2026). Annex III lists, among others, AI used to recruit or select people and AI used to assess creditworthiness (European Union, 2024).

Federally regulated financial institutions. OSFI's Guideline E-23 takes effect on 1 May 2027. It defines a model as an application of assumptions or statistical techniques, "including AI/ML methods", that processes input data to generate results, and it expects an inventory that records models with non-negligible risk (Office of the Superintendent of Financial Institutions, 2025). An agent that produces results for a bank is in that inventory.

None of these rules mentions an approval button. Every one of them asks you to show who decided, on what basis, and when.

What goes in an approval rulebook

One page per connected system is enough to start. I write each one in three parts.

What the agent may read. List the data zones by sensitivity. Default to nothing, and add access per task. This is the guidance's least-privilege recommendation turned into a table you can review (Australian Signals Directorate et al., 2026, p. 7).

What the agent may change, in three classes. I sort every action by impact and by whether it can be undone:

• Reversible and low impact (draft an email, open a ticket): the agent acts, and the action is logged.
• Reversible but consequential (update a customer record, change a price in a quote): the system owner approves first, and the approval screen shows the before and after.
• Irreversible or high impact (delete records, send money, change access, anything touching hiring): two people approve, or the agent is not allowed to do it at all.

Who approves, and what they must see. Name a role, not a team. State what the approver checks before clicking: the record, the change and the reason the agent gave. Then add the two log rules from the guidance: the agent has no write access to logs, and any request to delete a log waits for a person (Australian Signals Directorate et al., 2026, pp. 20, 22).

Before writing this I ran an open-source agent workspace on our own systems to see what the controls look like from the inside. The agent's code changes waited behind an approval step, a scheduled task it created was registered switched off, and every step listed what the agent had read. The controls were all there. What was missing, by design, was any rule telling me which of those approvals mattered. That is the gap this piece is about.

Where Sagentix fits, and where it does not

Sagentix Cyber & AI writes these rules with you; it does not choose your platform and it does not give legal advice. Interpretation of Law 25, the Employment Standards Act or the EU AI Act stays with your counsel. The entry point is the AI Agent Workspace Readiness Check: a register of the uses your teams plan, which of the rules above apply to each, data zones, and a written go/no-go memo. Its fixed price is stated on the call before any work starts. The research library behind it runs to 1,464 catalogued artifacts, and every deliverable passes an 19-check quality gate before it reaches you.

Three paths from here

Do it yourself this week. Pick the one system your first agent will touch. With its owner, list every action the agent could take there and put each one in one of the three classes above. Name an approver for the middle class. Expect to find actions nobody had thought to classify.

Give it to your second line. If you have a privacy officer or a risk function with capacity, the same exercise scales across systems, with the dated rules as columns.

Bring in help when the rulebook has to survive an outside reader. That is the case when a customer questionnaire, an auditor or a regulator will read it, or when hiring, credit or personal information is involved. Ask any adviser you evaluate whether they also sell or resell the platform they are recommending rules for.

References

• Australian Signals Directorate, Canadian Centre for Cyber Security, Cybersecurity and Infrastructure Security Agency, National Security Agency, National Cyber Security Centre (New Zealand), & National Cyber Security Centre (United Kingdom). (2026). Careful adoption of agentic AI services. Announced by the Canadian Centre for Cyber Security at https://cyber.gc.ca/en/news-events/joint-guidance-careful-adoption-agentic-artificial-intelligence-services
• Commission d'accès à l'information du Québec. (n.d.). Principaux changements apportés par la Loi 25. Retrieved October 31, 2026.
• European Union. (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union.
• European Union. (2026). Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 (Artificial Intelligence Act). Official Journal of the European Union.
• Government of Ontario. (2026). Your guide to the Employment Standards Act: Requirements related to publicly advertised job postings. Retrieved October 31, 2026.
• Green, B. (2022). The flaws of policies requiring human oversight of government algorithms. Computer Law & Security Review, 45, 105681. https://doi.org/10.1016/j.clsr.2022.105681
• Office of the Superintendent of Financial Institutions. (2025). Guideline E-23 — Model risk management (2027) (published 11 September 2025; effective 1 May 2027). Government of Canada.