How to Use This Fieldbook
A team evaluating AI-enabled workflows can easily collect a list of tools while overlooking what those tools can change. This fieldbook begins with one agent that interacts with a third-party application and follows its activity from the original business request to the permission decision, recorded outcome, and responsible person. The six worksheets are practical planning instruments. They are not the output of a security product, an external certification, or evidence that a real customer deployment has been tested.
Complete the worksheets with the business owner, Security, the application administrator, and any other function that owns the affected process. Use a safe test environment and existing approved records. The aim is to make uncertainty visible rather than fill empty fields with reassuring assumptions. NIST's 2026 AI Agent Standards Initiative identifies secure agent interaction and identity as active work areas [1]. That initiative is not an approval program for this fieldbook.
Worksheet 1: Choose One Real Business Action
Purpose and Fields
Start with the action that matters to the business. A service agent might read a support case, propose a classification, and change its status. A finance assistant might summarize a supplier document but must not change payment instructions. These distinctions should appear in the worksheet before discussion of models, connectors, or automation platforms. Name the outcome the business wants and the consequence of an incorrect action.
Fields to capture: Agent identifier ____; hosting application ____; connected application ____; business task ____; accountable sponsor ____; approved user group ____; data category ____; permitted result ____; excluded result ____; review date ____. Add the evidence source for the identity and permission record. A general vendor marketing page does not substitute for the organization's actual configuration.
Acceptance Test
Give the same use-case description to two reviewers. Ask each to classify four sample actions as permitted, prohibited, or requiring approval. Compare their answers. Differences reveal an unclear scope that should be resolved in business language before automation receives new access. NIST's AI RMF Map Playbook describes understanding the intended purpose and context of an AI system [2]. The worksheet is one possible practical application of that voluntary approach.
Worksheet 2: Map Every Connected Permission
Purpose and Fields
An agent may operate through a connected service account or under a user's delegated authority. Neither arrangement should give it more access than the approved task requires. For each connection, list the application, identity, information categories, permissible operations, expiry or review point, and person who can revoke access. Include external recipients and bulk export if the application makes those actions possible. Keep observed permissions separate from permissions merely requested in a design proposal.
Fields to capture: Connection ID ____; operating identity ____; authority source ____; read scope ____; write scope ____; share or export scope ____; approved recipients ____; expiry ____; revocation owner ____; observed permission check ____. If the platform does not expose an individual agent identity, note the actual shared identity and its limitation. NIST's August 2026 analysis explains why long-lived keys and coarse permissions warrant attention in agent environments [3].
Acceptance Test
In a nonproduction setting, perform one approved action and attempt one unauthorized operation. Preserve the connected application's response, the relevant event identifier, and the reviewer's conclusion. An agent's statement that it would never take a prohibited action is not a technical access test. The OWASP agentic-application list provides relevant test themes, including tool misuse and identity abuse [4].
Worksheet 3: Examine the Vendor and Customer Responsibilities
Purpose and Fields
Some controls belong to the application provider, some to the organization configuring an agent, and some to an integration service. A supplier questionnaire can describe provider practices without proving how each agent is configured in a customer's tenant. Work through the actual chain. Who issues credentials? Who chooses scopes? Who approves the business action? Who retains logs? Who can disable the connection? Record evidence available from each party and avoid treating an unanswered question as a confirmed control failure.
Fields to capture: Vendor or application ____; agent creator ____; tenant administrator ____; identity owner ____; permission approver ____; event source ____; provider control statement ____; customer configuration evidence ____; escalation path ____. A statement of responsibility should distinguish documented process from an observed control test. That boundary protects both the enterprise and the technology provider from overstated assurances.
Acceptance Test
Ask an application administrator and a business sponsor to independently explain how a newly enabled AI feature would be reviewed. Verify whether the named approver has authority over the actual connection. Microsoft documents agent lifecycle, ownership, and access management in certain Entra-supported environments [5]. Those are platform-specific examples; this worksheet applies without assuming every application offers the same controls.
Worksheet 4: Preserve a Reconstructable Action Trail
Purpose and Fields
A reviewer should be able to connect the request to what the application changed. The record may be distributed among agent activity logs, identity events, approval records, and system-of-record history. Do not create unrestricted copies of sensitive records for the sake of a dashboard. Instead, record secure pointers, retention periods, and the person authorized to review each source. For an action that was denied, record that observed outcome separately from an agent's explanation.
Fields to capture: Run or request ID ____; initiator ____; tool called ____; time ____; target business record ____; permission outcome ____; approval ID ____; application result ____; correction reference ____; reviewer ____; evidence location ____. NIST SP 800-53 provides broadly applicable control language for access, audit, and accountability [6]. It does not automatically certify the worksheet or a commercial platform.
Acceptance Test
Select two harmless test actions, one permitted and one rejected, and ask a reviewer who did not run them to reconstruct the sequence using the approved records. Record whether the reviewer can establish who acted, what changed, and how the event was authorized. If a link is missing, document the limitation rather than inventing an explanation. Recheck after any material change to the logging or application connection.
Worksheet 5: Design Human Review and Recovery
Purpose and Fields
A human approval step should happen before an action when its consequence makes preapproval appropriate. In other cases, monitoring and post-action review may be sufficient. Define these choices by business impact, data sensitivity, external reach, reversibility, and affected parties. Name the actual person or function authorized to interrupt a workflow. A dashboard alert is not an intervention procedure unless somebody can act on it.
Fields to capture: Consequence level ____; approval point ____; decision owner ____; alert recipient ____; suspension mechanism ____; restart authority ____; correction method ____; notification plan ____; last safe test ____; accepted limitations ____. ISO/IEC 42005:2025 describes impact assessment as a lifecycle discipline [7]. It provides guidance, not evidence that this organization's controls already meet a standard.
Acceptance Test
Simulate a proposed external message that should require approval. Then simulate a completed, incorrect record update in a safe environment. Show how the first is stopped and how the second is corrected. Note that a sent external message might require notification or compensation, not a simple rollback. Preserve the results as observed evidence, not as a guarantee that every future action can be reversed.
Worksheet 6: Govern Changes and Retirement
Purpose and Fields
A workflow can become riskier after a vendor adds a feature, an employee grants an integration broader access, or a team changes the business task. Define which changes require a new review and when a discontinued agent's credentials will be withdrawn. Keep a version of the original approval. The person who created an agent may leave the organization, but responsibility for the connection must not disappear with that employee.
Fields to capture: Approved version ____; changed application ____; new data scope ____; new action scope ____; previous owner ____; proposed owner ____; approval decision ____; effective date ____; retirement steps ____; evidence-retention rule ____; next review date ____. Obsidian Security's 2026 analysis highlights the gap between a periodic supplier assessment and evolving agents inside third-party applications [8]. This is a vendor editorial view, not proof of measured adoption or complete runtime coverage.
Acceptance Test
Ask a reviewer whether adding write access to a previously read-only connection would reopen authorization. Simulate a sponsor departure and verify the responsibility-transfer process. Test retirement by checking that only the intended credentials and connections are removed, with records retained under the organization's policy. Document the result and the environment in which it was observed.
Worked Example: A Fictional Customer Support Agent
A hypothetical support team deploys an agent that reads approved case fields and proposes a draft customer response. It is not authorized to export the customer list, change account billing details, or send the message without review. A Support Operations Manager owns the business decision, IT administers the application account, and Security reviews data access. If the team later wants the agent to send low-risk responses automatically, the request requires a new business approval and a technical access test. This fictional scenario illustrates a decision, not a vendor implementation or customer result.
The team records an allowed read, a denied export, and a draft awaiting human review. Each record links to an event source and an accountable decision. If the application cannot produce an agent-specific event, the team notes which human or service identity can be observed and which questions remain unanswerable. A governance record becomes credible when it describes observed evidence and its limits in the same place.
A Practical 30-Day Pilot Plan
Days 1–5: Select one workflow and complete Worksheet 1 with the business sponsor.
Days 6–10: Map the connected identity, approved action list, and denied test in Worksheet 2.
Days 11–15: Establish the shared-responsibility record and verify relevant application settings.
Days 16–20: Reconstruct two safe events and test the review and recovery path.
Days 21–25: Conduct an independent check of the records and disagreements.
Days 26–30: Simulate one scope change, record the decision, and set the next review date.
These periods are an illustrative planning sequence, not an asserted implementation timeline.
Continue With a Defined Governance Conversation
After completing the worksheets, compare decisions made by your team with the campaign resource on governing agent actions in third-party apps. Use it as an additional discussion aid, not as proof of a tested implementation.
Campaign Resource: https://intentamplify.com/landing-page/ebook/govern-agent-actions-third-party-apps
The Intent Amplify Perspective
For technology vendors, a practical fieldbook can help Security, IT, and business buyers discuss a specific operational need before comparing products. Intent Amplify Managed Demand Generation describes coordinated audiences, approved content, response validation, and reporting [9]. A completed worksheet is an educational interaction; it should not be described as a confirmed project, budget, compliance failure, or qualified commercial opportunity without independent evidence. When a buyer requests a technical evaluation, that next step should have its own acceptance criteria.
Readiness Review: Evidence Over a Single Score
For every worksheet, assign one of four descriptive states: Not documented, documented, safely tested, or used in an approved workflow. Report the reviewed population, test date, and owner. Do not convert an incomplete record into a favorable percentage by excluding difficult cases from the denominator. A severe untested permission boundary should remain visible even when the other worksheets are complete. Review the status again after changes to tools, business rules, or the human sponsor.
Evidence Notes and References
Numbered references identify sources for adjacent factual statements. Practical tests, models, and examples are original editorial synthesis, not measured customer results. Official guidance and legal duties apply only within their stated scope. Vendor product descriptions do not prove a specific deployment. Sources reviewed November 4, 2026.
- NIST, Announcing the AI Agent Standards Initiative (February 17, 2026). https://www.nist.gov/news-events/news/2026/02/announcing-ai-agent-standards-initiative-interoperable-and-secure
- NIST, AI Risk Management Framework Playbook: Map (Voluntary guidance). https://airc.nist.gov/airmf-resources/playbook/map/
- NIST, Back to the Future: Why Agentic AI Needs a Strong Identity Foundation (August 27, 2026). https://www.nist.gov/blogs/cybersecurity-insights/back-future-why-agentic-ai-needs-strong-identity-foundation
- OWASP Gen AI Security Project, Top 10 for Agentic Applications for 2026 (Published December 2025; community guidance). https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
- Microsoft Learn, Manage Agent Identities in Your Organization (2026; first-party platform documentation). https://learn.microsoft.com/en-us/entra/agent-id/manage-agent-identities-admin
- NIST, SP 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations. https://csrc.nist.gov/pubs/sp/800/53/r5/final
- ISO, ISO/IEC 42005:2025, AI System Impact Assessment (Official standard description). https://www.iso.org/standard/42005
- Obsidian Security, Governing AI Usage Inside Third-Party Apps (July 30, 2026; vendor-authored perspective, not independent test evidence). https://www.obsidiansecurity.com/academy/governing-ai-inside-third-party-apps
- Intent Amplify, Managed Demand Generation (Official service description). https://www.intentamplify.com/solutions/managed-demand-generation
