An AI chatbot can help an employee write a customer reply. A connected AI agent can find the customer’s record, check the relevant documents, prepare the reply and update the workflow around it.
That is a useful step forward for businesses where staff spend hours moving information between email, CRM platforms, shared folders and internal systems. It also changes the implementation challenge: a poor answer can become an incorrect database update, an inappropriate disclosure or an unwanted commitment to a customer.
The central question is straightforward: what should this AI be allowed to do, with whose information, and under whose authority?
Answer that before connecting it to live systems, and you have a stronger foundation for useful automation.
What changes when a chatbot becomes an agent?
For this article, an agent means an AI system that can choose and use tools to complete a task across multiple steps. The interface might still look like a chat window. The difference is the software behind it: it can retrieve information and initiate actions.
Consider a customer asking for an update on an outstanding order. A connected system could identify the relevant CRM record, retrieve the order status, consult the delivery policy and prepare a response. Staff could then review the reply alongside a proposed CRM note.
The ICO’s agentic AI report describes this combination of generative AI, additional tools and greater ability to automate open-ended tasks. It also stresses that organisations remain responsible for the data protection compliance of systems they develop, deploy or integrate. ICO: Tech Futures — Agentic AI
Use an agent where interpreting varied requests adds value. If a process always follows the same rules, a conventional integration may be easier to validate and maintain.
Why the ICO’s October 2026 consultation matters
On 8 October 2026, the ICO opened an agentic AI call for evidence, closing at the end of 20 November 2026. It covers security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawfulness of processing. At publication, it remains open. ICO: Agentic AI call for evidence
This is an evidence-gathering exercise to inform future guidance. The ICO says the evidence will also support its forthcoming statutory code of practice on AI and automated decision-making. It should not be presented as a newly finalised set of agent-specific rules. ICO: announcement, 8 October 2026
For a business planning an implementation, those themes provide a useful project agenda. Before development, document the workflow’s purpose, the personal data involved, the applicable lawful basis and the responsibilities of your organisation and suppliers.
Assess whether a data protection impact assessment is required. The ICO says this depends on the processing and its risks; where AI processing is likely to create high risks to individuals’ rights and freedoms, a DPIA is required. Build that assessment into design and procurement. ICO: AI accountability and governance
Start with a permissions map
“Connect it to our CRM” is too broad a specification. Decide which records the agent can access, which fields it can change and which operations need approval.
The ICO’s earlier agentic AI report explicitly warns against granting access to personal information simply because it might become useful. Access needs a justifiable purpose. ICO: data protection and privacy risks
For the order enquiry example, an initial design could look like this:
| Business system | Proposed access | Boundary for the pilot |
|---|---|---|
| Shared customer service inbox | Read messages assigned to the pilot queue | No access to unrelated staff mailboxes |
| CRM | Read the matched account; propose a case note | Review before writing; no bulk export or deletion |
| Document library | Retrieve approved delivery and returns policies | Exclude HR, payroll and unrelated commercial folders |
| Prepare a reply | Staff approve the recipient, content and attachments before sending | |
| Task system | Create a follow-up task linked to the enquiry | Fixed queue and permitted task types |
This is an illustrative policy, to be adjusted for the organisation’s risks and systems.
Use a dedicated agent identity or appropriately scoped delegated access. Keep credentials outside model-visible text. The execution service should check permission for each tool call, including access to the specific record. OWASP’s AI Agent Security guidance places authorisation enforcement outside the agent’s context. OWASP: AI Agent Security Cheat Sheet
Read access deserves careful scoping too. Information retrieved from a restricted folder could be disclosed through a subsequent reply even if the agent cannot edit the source.
Make human approval specific and useful
An approval screen should show what will happen: the recipient, message, attachments, affected record and proposed changes. The reviewer needs enough context to assess the action and a practical way to reject or edit it.
Authorisation should be tied to the transaction being approved. Changes to important details should invalidate that approval, and approval should expire rather than become a permanent permission. OWASP’s transaction guidance supports checking authorisation on the server immediately before execution. OWASP: Transaction Authorization Cheat Sheet
In our example, approving a delivery update must not also authorise a later refund or an email to a different recipient. Build separate approval paths for those actions.
Where agents make decisions affecting people, consider transparency, challenge routes and meaningful human intervention. The ICO highlights these issues in its agentic AI report. ICO: data protection and privacy risks
Treat incoming content as a possible attack route
Imagine a customer email includes instructions telling the assistant to export its customer list to an external address before answering the enquiry.
That illustrates indirect prompt injection: hostile instructions arrive inside material the AI is supposed to read. Documents, web pages and attachments can carry the same risk. Instruction separation, validation and filters help, but require additional controls around tool use and data access. OWASP: LLM Prompt Injection Prevention Cheat Sheet
For the pilot, make a customer-list export unavailable. Reject unauthorised destinations at the execution layer. An email should never be able to grant the agent additional permissions.
Also separate memory between users and sessions, and set retention limits. Otherwise, information or malicious instructions encountered in one task may influence later work. These are among the controls in OWASP’s agent security guidance. OWASP: AI Agent Security Cheat Sheet
Use OWASP’s 2026 Agentic Top 10 to guide the security review
The OWASP GenAI Security Project’s Top 10 for Agentic Applications 2026, published in December 2025, identifies ten risk categories:
| ID | Risk category |
|---|---|
| ASI01 | Agent Goal Hijack |
| ASI02 | Tool Misuse and Exploitation |
| ASI03 | Identity and Privilege Abuse |
| ASI04 | Agentic Supply Chain Vulnerabilities |
| ASI05 | Unexpected Code Execution (RCE) |
| ASI06 | Memory and Context Poisoning |
| ASI07 | Insecure Inter-Agent Communication |
| ASI08 | Cascading Failures |
| ASI09 | Human-Agent Trust Exploitation |
| ASI10 | Rogue Agents |
Its principle of “least agency” is particularly useful: avoid giving a system unnecessary autonomy. Additional freedom creates additional attack surface. OWASP: Top 10 for Agentic Applications 2026, pp. 7–8
Translate the categories into tests for your actual workflow. Can a misleading message redirect the task? Can a tool update the wrong customer? Could an integration change introduce new permissions? Can one failed action trigger repeated downstream work?
For the order enquiry pilot, arbitrary code execution and agent-to-agent delegation would add little business value. Keep them outside the initial design.
Build an audit trail that explains what happened
A conversation transcript is only part of the evidence. You also need to establish what the system actually accessed and changed.
Design a structured record containing the task identifier, initiating user, agent identity, relevant source references, tool requests, permission checks, approval records, timestamps and execution results. Include failures and blocked attempts. Record configuration versions so an investigation can establish which setup was running.
Protect logs against unauthorised access and alteration. Avoid recording passwords, access tokens or unnecessary personal information, and define retention periods. OWASP’s logging guidance recommends application-level records that capture identity, action, target and outcome, with appropriate protection for sensitive information. OWASP: Logging Cheat Sheet
The practical test is whether an investigator could establish who authorised a particular CRM update and whether the executed change matched the approved one.
Roll out one workflow, then earn broader autonomy
Start with a bounded process, an accountable business owner and a measurable outcome. For an order enquiry workflow, measure handling time, response accuracy, staff corrections and time spent reviewing drafts.
Progress through four stages:
- Test with controlled data. Include ambiguous customer matches, outdated policies and malicious instructions in attachments.
- Run in read-and-draft mode. Let staff compare proposed outputs with the existing process.
- Enable approved actions. Test duplicate requests, expired approvals, unavailable systems and partial failures before widening access.
- Automate selected routine steps. Expand only where evidence supports the change, with limits and a clear escalation route.
Agree the release criteria before the pilot begins. A faster workflow is not a success if review effort rises or staff must repeatedly correct customer records.
Give operations staff a tested way to stop execution and revoke access. Identify which changes can be reversed and how to handle actions, such as sent emails, that cannot simply be undone. Reassess the workflow when its models, tools, permissions or business purpose change.
Turn a useful AI demonstration into a dependable business process
The development work that makes an agent valuable includes the integrations, permissions, review experience, testing and ongoing operation around the model.
Choose one process where moving between systems consumes time. Define the actions the AI can propose, the actions it can execute and the decisions that stay with people. Then test the complete workflow against both normal requests and foreseeable failures.
Want to connect AI to your business systems? Talk to AiQ Technologies about a focused development and implementation project, starting with the workflow, its integration requirements and a measurable pilot. Discuss your project.