“Not without someone approving every action”

CISO · Integration and automation

A CISO who won't let AI agents make changes without approval is doing their job: software that acts on its own inside business systems is a new kind of risk. Don't argue for less control. Ask where the line is: which actions would need a person to sign off and which wouldn't, then show how that line is enforced.

What the buyer says

You want AI agents making changes in our systems? Not without someone approving every action.

How to handle it

Listen

Notice that the CISO isn't saying no to agents. "Not without someone approving" tells you the question is control and accountability.

Acknowledge

Agree that software acting inside business systems needs clear limits, and that someone must be accountable for what it does.

Explore

Ask which actions worry them most: changing records, moving money, sending messages, granting access. Ask which low-risk actions they'd be comfortable automating, and what they'd need to see: logs, limits, approvals or the ability to undo.

Respond

Show how approvals, permissions and audit trails work in your product for the actions they named. Propose starting with low-risk actions under full approval, and widening only when they're comfortable.

Say this
“That's the right instinct. Software acting in your systems needs clear limits.”

Say this
“Which actions would always need a person to sign off?”

Say this
“What would you need to see, such as logs or the ability to undo, before trusting it with the low-risk ones?”

Variations

Head of Risk: “Who's accountable when the AI gets it wrong?”
Data Protection Officer: “I need to know exactly what data an agent can see and change.”

Questions people ask

How do you respond when a CISO won't let AI agents act without approval?

Agree that agents need clear limits. Ask which actions must always have a person's approval and which low-risk ones could run on their own, then show how approvals, permissions and audit trails enforce that line in your product.

What controls do security teams want before allowing AI agents?

Typically: approval for higher-risk actions, tightly limited permissions, a full record of what the agent did and why, and a way to stop or undo its actions. Ask each buyer which of these matter most to them.