An agent opens a government site to help your team complete a filing. Reading the instructions is useful; clicking “Submit” could make a declaration on the company’s behalf. AI agent action permissions need to distinguish those steps before the agent reaches the page.
Key takeaways
- Let an agent read form instructions and prepare answers using information it is authorized to access.
- Treat saving a draft, uploading a document, and submitting a form as separate actions with separate permissions.
- Require a person with the right authority to review the completed form and approve submission. Enforce that boundary in the tool or browser workflow, not just in a prompt.
- Give reviewers the source behind each material answer. Source citations help them check a draft; they do not authorize the agent to file it.
AI agent action permissions are rules that govern which operations an agent may perform, on which resources, and under whose authority. For a government form, those rules might allow reading public instructions and drafting answers while blocking uploads or final submission. A useful permission decision also considers the specific form, the account being used, and whether a human has approved the action.
How should AI agent action permissions work on forms?
Draw the boundary around actions, not websites. Access to a government portal does not mean an agent should be able to perform every operation available there. An agent may need to read filing requirements without changing an account, attaching a sensitive document, or sending a declaration.
| Action | Sensible starting permission | Why it deserves its own rule |
|---|---|---|
| Read public instructions | Allow | The agent can identify required fields and deadlines without changing a record. |
| Read a company account or prior filing | Allow only with appropriate access | The material may contain private or regulated information. |
| Draft answers outside the portal | Allow with review | A draft can be checked against company records before anyone relies on it. |
| Save a draft in the portal | Require explicit scope | A saved draft may change shared state or expose information to other account users. |
| Upload an attachment | Require separate approval | The wrong file may disclose confidential information. |
| Submit, certify, or pay | Require an authorized human’s approval | The action may create an official record, assertion, or financial commitment. |
This is a starting policy, not a statement about every government portal. The effect of “Save,” “Continue,” or “Submit” depends on the particular form. Check the portal’s behavior and your organization’s filing requirements before automating any step.
The distinction between who grants access and what an agent may do matters here. Oso’s guide to delegated agent access discusses delegated versus application-wide permissions. For a filing workflow, an agent acting for a specific employee should receive only the access needed for that employee’s assigned task, rather than a general credential that can act across the organization.
Why does a human approval step need a technical boundary?
A prompt asking an agent to stop before submission is an instruction, not an enforced permission. The agent may encounter an unfamiliar button, misread a page, or follow instructions embedded in content it was supposed to inspect. The approval step should therefore be implemented where the action occurs: in the available tool calls, browser controls, credentials, or an approval workflow that withholds the final action until a person authorizes it.
For example, an agent can assemble answers for a permit renewal and present a review packet. That packet should show the proposed answers, attachments, filing destination, and supporting records. A designated employee then checks the packet against the live form and performs or expressly authorizes the final submission. If the agent cannot be prevented from pressing the final button, limit it to producing the review packet outside the portal.
Permission should also expire. Approval to submit one identified form for one company account should not become standing authority to file future forms. Record who approved the action, what version they reviewed, and what the portal returned. If the form changes after approval, require another review.
Arthur’s discussion of government agent governance describes the gap between a human-oversight policy and controls that enforce it while agents run. The same operational problem applies to a business using an agent on a government site: a policy document cannot stop a tool call by itself.
What company information should the agent be allowed to use?
The agent needs enough evidence to draft accurately, but its reading scope should match the filing task. A request to complete a registration form may require the company’s legal name and address. It does not justify searching every private message or retrieving an unrelated customer contract.
Suppose an agent is drafting an answer about the company’s current business address. It could use an authorized record in Google Drive and flag a conflicting address in a relevant email for human review. The reviewer should see which source supports the proposed answer and when it was recorded. If those sources disagree, the agent should surface the conflict rather than choose an address because it appeared first.
This is where a company brain built from selected business apps can help. Gyld indexes the data a company chooses from apps such as Google Drive, Gmail, Slack, and Salesforce, and makes permissioned, source-cited knowledge available to AI tools through MCP servers. Private, team, and company-wide knowledge have different access scopes. That gives an agent evidence for a draft; it does not give Gyld authority to approve, upload, or submit a government filing.
Keep those two control planes separate. The context layer decides what company knowledge the agent can retrieve. The agent’s tools and the destination site determine what actions it can attempt. Teams comparing ways to supply that evidence can also review Gyld’s comparison with a hand-built RAG approach.
What should a team authorize today?
Start with one form and write down every step the agent can take before giving it portal access. A small test reveals whether your proposed boundary is enforceable.
- List the exact form, account, required records, attachments, and authorized reviewer.
- Classify each step as read, draft, save, upload, submit, certify, or pay. Do not group them under a single “use website” permission.
- Check which steps the agent’s tools and credentials can actually block. Remove a tool or credential if its permission is broader than the task.
- Require a review packet with proposed answers and source references. Resolve conflicting or missing facts before approval.
- Test the stop point: can the agent submit without the reviewer? If yes, keep it out of the submission flow.
- Keep a record of the approved version and the filing receipt, if a person submits it.
AI agent action permissions work when the last meaningful step stays with the person accountable for it. The agent can reduce the work of finding facts and preparing a draft, while the organization retains control of the filing.
Related reading
- AI Agent Governance for Business: Who Controls What Agents Do? — a broader look at assigning authority over agent actions.
- Personal AI Agents for Work: The Company Context Test — questions to ask before an agent uses company information.
Frequently asked questions
Can an AI agent fill out a government form?
An agent can help read instructions and draft answers if it has appropriate access to the required information. Whether it can enter, save, or submit those answers depends on the portal, the organization’s authority, and the controls available in its tools. Have an authorized person verify the final form.
Is saving a draft the same as submitting a form?
No. Saving and submitting are distinct actions, but a saved draft can still change a shared account or expose entered information. Check what the specific portal does when a draft is saved, and give the agent that permission separately from submission.
Is human approval in the prompt enough?
No. A prompt cannot reliably enforce a stop point if the agent still has a tool and credential capable of submission. Restrict the action through tool access, credentials, or a workflow that requires approval before the final step.
Who should approve an agent-prepared filing?
A person authorized by the organization to review that filing should approve it. They need to see the completed answers, attachments, supporting sources, and any unresolved conflicts before submission. The appropriate approver depends on the form and the organization’s responsibilities.
Does a company brain give an agent permission to submit forms?
No. A company brain can supply permitted, source-cited business information for an agent’s draft. Submission authority must be handled separately in the agent’s tools and the filing workflow.
If your agent needs reliable company facts before a person files, start building your company brain with Gyld. Connect a source such as Google Drive or Gmail, then check a draft answer against the record it came from.