Key Takeaways
- AI agents act, not just answer, so controls must cover what they can touch and how fast you can stop them.
- Seven terms form the core vocabulary: kill switch, agent identity, least privilege, AI gateway, agent register, approval gate and environment segregation.
- The PCPD's August 2026 guidance keeps the organisation accountable for any personal data an agent processes.
- Ask every vendor and internal team to show each control working before an agent goes live.
The risk committee meets on Thursday. On the agenda: an AI agent that reconciles supplier invoices, drafts payment instructions and emails vendors. The first question from the chair will not be about accuracy. It will be: if this agent does something wrong at 2 a.m., who can stop it, and how quickly?
Answering that question takes a shared vocabulary. Agent control has developed its own terms over the past year, and in November 2026 they moved from security conferences to board papers. Here are the seven you are most likely to hear.
What is an AI agent kill switch?
An AI agent kill switch is a control that lets an authorised person stop one agent, or every agent, immediately and stop it from restarting. It cuts the agent off from the models and systems it uses, so a misbehaving agent cannot keep acting while the team investigates what went wrong.
The term went mainstream on 3 November 2026, when CrowdStrike announced an AI Kill Switch in its Falcon Guardian product. The first version blocks agents at the AI gateway, so they lose access to the models that drive their decisions; CrowdStrike says termination on the endpoint will follow.
What it means for your organisation
A kill switch is only useful if someone is named to use it, the trigger conditions are written down, and stopping the agent does not break the business process it supports. Decide the manual fallback before you need it.
Example
A logistics firm's booking agent starts confirming shipments at the wrong rate after a supplier changes its price file. The operations duty manager stops that one agent in a single action, the team returns to manual booking for the evening, and the agent is restarted only after the rate table is fixed.
What is AI agent identity?
AI agent identity is a distinct, managed account for each agent, separate from any human user. It lets systems see which agent did what, apply that agent's own permissions, and switch it off without locking out a person. Agents that borrow a staff member's login cannot be governed separately.
Security teams often call these non-human identities. The point is simple: if an agent signs in as a staff member, every log entry looks like that person, and revoking the agent means revoking the person.
What it means for your organisation
Every agent in production should have its own identity in your identity system, an owner, an expiry date and a list of the systems it may reach. That one step makes the next six controls possible.
Example
A property management company finds its tenant enquiry agent has been using the shared mailbox of the customer service manager. It creates a dedicated agent account, moves the mailbox permission to it, and the audit log now shows agent actions on their own line.
What is least-privilege access for AI agents?
Least-privilege access means an agent receives only the permissions its task needs, and nothing more. A summarising agent can read but not send; an invoice agent can draft but not approve. It limits the damage from a mistake, a prompt injection attack or a compromised agent account.
The PCPD's guidance on agentic AI, published on 25 August 2026, notes that agents often run with broad default access to files, emails and stored credentials. Reed Smith's summary lists least-privilege access among the first technical safeguards organisations should put in place.
What it means for your organisation
Permissions tend to grow during a pilot because it is easier to grant access than to work out exactly what is needed. Review agent permissions before go-live and every quarter after, as you would for a privileged human account.
Example
A wealth management firm's research agent needs market data and internal notes. It does not need client account records, so the IT team removes that access and the agent's risk rating drops from high to medium.
What is an AI gateway?
An AI gateway is a control point that sits between your agents and the AI models or tools they call. Every request passes through it, so the gateway can log usage, filter sensitive data, enforce spending limits, route traffic to approved models and block an agent when needed.
Without a gateway, each team connects its agents directly to model providers, and policy has to be rebuilt in every connection. With one, the security and finance teams can set rules once.
What it means for your organisation
A gateway is where several other controls live in practice: the kill switch, data masking, model approval lists and cost caps. If you run more than a handful of agents, it is usually the first piece of shared infrastructure worth funding.
Example
A retail chain routes all agent traffic through one gateway. When a new model version produces poor product descriptions, the platform team switches the marketing agents back to the previous model in one change, with no edits to the agents themselves.
What is an agent asset register?
An agent asset register is a single, current list of every AI agent the organisation runs: what it does, who owns it, which data and systems it can reach, how autonomous it is and when it was last reviewed. You cannot govern, audit or switch off agents you do not know exist.
Gartner predicts that 40% of enterprise applications will include task-specific AI agents by the end of 2026, up from less than 5% in 2025. Many of those agents arrive inside software you already pay for, which is why inventories go stale quickly.
What it means for your organisation
Treat the register as you treat your IT asset list: one owner, a review cycle and a rule that no agent goes live without an entry. The PCPD guidance also points organisations towards keeping such a register.
Example
A professional services group surveys its departments and finds 23 agents in use, against the 6 the IT team knew about. Nine are switched off, eight are moved onto approved platforms, and the rest are added to the register with owners.
What is a human-in-the-loop approval gate?
A human-in-the-loop approval gate is a defined point in an agent's workflow where a named person must approve before the agent continues. It is placed on actions that are costly, irreversible or affect customers' personal data, while routine steps run without waiting for anyone.
Continuous risk assessment with a human in the loop is one of the nine recommendations in the PCPD's agentic AI guidance. The practical skill is choosing where the gates go: too many and the agent delivers no saving, too few and you carry risk you have not priced.
What it means for your organisation
Set gates by value and reversibility. A common pattern is automatic action below a set amount, one approver above it, and two approvers for anything that cannot be undone.
Example
A manufacturer lets its procurement agent reorder standard parts automatically up to an agreed limit. Orders above the limit, or any new supplier, wait in a queue for the purchasing manager, who clears them twice a day.
What is environment segregation for AI agents?
Environment segregation means running agents in separated spaces, with their own network rules, data copies and accounts, so an agent being tested or one that goes wrong cannot reach production systems or unrelated data. It is the agent equivalent of keeping a test server apart from live customer systems.
The PCPD lists environment segregation and network controls among its security safeguards for agentic AI. It matters most for agents that can operate a computer or browser, because those agents can reach anything the machine can reach.
What it means for your organisation
Run new agents in a sandbox with masked or synthetic data first, then promote them to production in stages. Keep agents that handle personal data in a separate zone from agents that browse the public web.
Example
A healthcare administration provider tests its appointment agent on a copy of the booking system filled with dummy patient records. Only after four weeks of clean results does the agent connect to the live system, and it still has no internet access.
Use the glossary as a go-live checklist
These seven terms work best as questions. Before any agent goes live, ask: Does it have its own identity? Is it on the register? Are its permissions the minimum? Does its traffic pass through a gateway? Where are the approval gates? Is it segregated? Who holds the kill switch, and when was it last tested?
If a team or vendor can answer all seven with evidence rather than slides, the agent is ready for a controlled launch. If not, you have a clear list of what to fix first. The goal is not to slow AI down, but to keep your organisation in charge of what its agents do.
Empowering AI. Centered on you.
Put controls in place before your first AI employee starts work
UD's AI Staff Solution deploys AI employees with data kept in Hong Kong in line with the PDPO, zero setup fee and a UD team handling configuration. Book a free AI employee assessment to see which role to start with.
Frequently Asked Questions
Is the PCPD's agentic AI guidance legally binding?
No. The guidance is non-binding and principles-based, but the PDPO itself still applies, and the organisation remains accountable for personal data its agents process.
Do we need a kill switch if our vendor already has one?
You need to know who in your organisation can trigger it, how fast it works and what happens to the business process afterwards. A vendor feature without an internal owner is not a control.
What is an agent audit trail?
A time-stamped record of every action an agent takes, the data it used and the approvals it received, so you can explain any outcome to a regulator, client or auditor.
How long does it take to set these controls up?
It depends on how many agents you run. Starting with one agent, most organisations can set up identity, a register entry, scoped permissions and approval gates during the pilot.
Which control should we fund first?
Start with the agent register and agent identities, because every other control depends on knowing which agents exist and telling them apart from staff.