This is a free browser tool on circuits.fit.
Write down what an agent may touch before it is turned on.
On September 30, 2026, Gartner reported that 54% of organizations have no defined approach to limiting AI agent access, or rely on predefined human access, based on a second-quarter survey of 297 cybersecurity leaders. Gartner’s advice is to treat frontier AI deployments as insider risks and to govern agents by their action privileges rather than by how capable the model is. An agent that reuses a person’s login can do everything that person can do, at machine speed, and the logs will show the person.
This sheet makes the limit explicit before an agent is switched on: what it may read, what it may write, which tools or APIs it may call, how much it may spend per day, who owns it, and whether a person approves writes and spending.
Not legal, tax, insurance, or procurement advice. Inputs stay in this browser. Nothing is uploaded.
Top comments (0)