AI agents now act on your behalf — shopping, booking, emailing customers. The BCG “Authorization Gap” finding is blunt: agents can obey every rule and still cause harm. One agent bumped a customer off a gym waitlist; another published flawed guidance an engineer trusted. Neither broke a rule. Both caused real damage.

This one-page checklist turns that finding into a 30-day plan. In the next 30 days:

every agent operating in your environment — bought, built, or shadow-deployed by employees.

Name an owner for each one — a human who can answer “who authorized this agent?” and has kill-switch authority.

3. Write a customer-portal policy: allow third-party agents, deny them, or allow with verified identification.

. Give agents org-chart homes — permissions, reporting lines to human owners, the same way you'd onboard a new hire.

horization, not just compliance — ask what harm an agent could cause within its permissions.

Set the rule for agent spending — who approves an agent's purchases, and with what limits?

quire identification in the open — agents that act on external sites must disclose they're automated.

the bouncers — the guardrails (endpoint controls, policy layers, browser isolation) that can stop a rogue agent when permissions aren't enough.

Plus the four questions your board should be able to answer: Which agents operate here? What is each authorized to do? Who delegated that authority? What stops one that goes rogue?

DistilledAiDigest — the week's most important AI stories, distilled.