AI agent governance is the set of system controls that decide what an agent may do on its own, what a human must approve, and what it may never touch. Most GTM teams turned agents on before they wrote any of that down. This is the operator playbook for HubSpot and Salesforce: tiers, permissions, logs, kill switch.
Takeaway: the problem is not the agent. It is the missing layer that says which decisions it owns.
Most teams adopting AI are making the same mistake they made with every other tool: no governance layer.
They're plugging agents into workflows, automating sequences, letting AI score leads and route deals. And nobody has defined the decision boundaries.
Which decisions can the agent make autonomously? Which ones require human review? What's the escalation path when the model gets it wrong?
Without this, you don't have automation. You have unmanaged risk running at machine speed.
HubSpot just shipped Smart Deal Progression — AI that reads call transcripts and suggests CRM updates automatically. That's powerful. It's also the exact kind of feature that needs a human-in-the-loop protocol to validate before you turn it loose on your messy pipeline data.
The companies winning with AI right now aren't the ones deploying the most agents. They're the ones who built the control framework first. Decision boundaries documented. Override protocols defined. Audit trails in place.
AI without governance is just faster chaos.
Build the system around the agent, not the other way around.
Takeaway: agents rarely fail because the model is bad. They fail because they were given a human's keys, a prompt instead of a permission, and dirty data to reason over.
Someone connected the integration with their own Super Admin login, or a shared admin user. Now the agent can do anything that person can: edit every deal, export every contact, change every workflow. OWASP lists this as a top agentic risk (identity and privilege abuse). One bug or one poisoned email in a free-text field, and the blast radius is your whole CRM.
"Never change closed-won deals" written in agent instructions is a suggestion. Models skip instructions, and injected text can override them. Singapore's 2026 Model AI Governance Framework for Agentic AI is blunt about it: prefer controls the system enforces over instructions in prompts.
This is the gap the post names. No one wrote down which actions are autonomous, which need review and which are off-limits. So the default is whatever the vendor shipped, and vendors ship features that update records.
An agent reading five versions of close date makes confident wrong updates five times faster than a rep. 84% of data and analytics leaders say AI output quality depends on input data quality (Salesforce). The agent amplifies whatever your definitions already are, which is why CRM data hygiene comes before autonomy.
HubSpot's centralized audit log covers 30 days. Salesforce keeps Setup Audit Trail for 180 days. If an agent quietly rewrote lifecycle stages six weeks ago and nobody exported the logs, you cannot prove what changed or why.
Takeaway: "strong" is not more paperwork. It is one identity per agent, read-only by default, approvals enforced in the tool, and logs you own.
| Control | Weak | Acceptable | Strong | Source |
|---|---|---|---|---|
| Governance policy | None (63% of orgs) | Written policy, not enforced in tools | Policy plus a per-agent decision register enforced in permissions | IBM 2025 |
| Agent identity and access | Runs on a person's admin token | Shared integration user with role-based access | Own user or app per agent, least privilege, one named owner | IBM 2025; IMDA 2026 |
| Write access | Full write on every object | Write on the objects it needs | Read-only by default; writes per field; high-impact writes require confirmation | Salesforce admin guidance 2026; IMDA 2026 |
| Audit evidence | Native retention only (HubSpot 30 days, SF Setup Audit Trail 180 days) | Monthly export | Weekly export to your own warehouse | HubSpot KB 2026; Gearset 2026 |
| Field history on agent-written fields | Not tracked | Tracked on key fields (SF: up to 20 fields per object, about 18 months) | Tracked plus long-term archive (Field Audit Trail or warehouse snapshots) | Gearset 2026 |
| Testing before release | Tested in production | One-off sandbox test at launch | Regression tests on every prompt, model or permission change | Agentforce guidance 2026; IMDA 2026 |
| Human oversight quality | Approvals exist, nobody measures them | Override rate reviewed monthly | Override rate and review time tracked weekly to catch rubber-stamping | IMDA 2026 |
Sources: IBM Cost of a Data Breach Report 2025 (Ponemon, 600 orgs); IMDA Model AI Governance Framework for Agentic AI (2026); HubSpot Knowledge Base, audit logs (2026); Gearset, Salesforce audit trail guide (2026); Salesforce admin guardrails guidance (2026). Weak / acceptable / strong thresholds are JayOh operating standards built on those sources.
Irreversible or customer-facing = human approvesRead by default. Write per field. Never delete.4 clean weeks under 2% error = drop one tierTakeaway: inventory, identity, tiers, enforcement. Then inputs, testing, logs, kill switch and a weekly review that lets agents earn autonomy instead of starting with it.
Takeaway: narrow agents, real permissions and measured oversight. Most expensive mistakes are access mistakes, not model mistakes.
Takeaway: score one agent action at a time. The calculator tells you its tier, how many errors it will ship per week, and whether human review pays for itself.
Math: error rate = 100% minus accuracy. Errors per week = actions × error rate. Review hours = actions × minutes ÷ 60. Net review value = errors × cost × 90% minus review hours × hourly cost. Risk score = 60 × (impact − 3) ÷ 6 + 40 × min(error rate ÷ 20%, 1). Tiers follow the decision register rules in step 3: irreversible and customer-facing is T4; irreversible, a key field that is hard to undo, a risk score of 55 or more, or accuracy under 85% is T3.
Takeaway: one register per agent. If you cannot fill in every line, the agent is not ready for write access.
AGENT DECISION REGISTER Agent name: One-line job (one job only): System: HubSpot / Salesforce / other Business owner (answers for outcomes): Technical owner (on call, can disable): Runs as (agent user / private app, never a person's admin login): Permission set or app scopes: READS (objects and fields): WRITES (fields only, never whole objects): ACTIONS AND TIERS T0 Read / summarize (autonomous): T1 Draft / suggest, human sends (autonomous): T2 Reversible low-risk write (autonomous, logged, 10% weekly sample): T3 High-impact write or send (human approves each): T4 Forbidden (no permission granted): ENFORCEMENT (how each T3 and T4 is blocked in the system): Approval step location: Field-level permissions applied: TESTING Sandbox test set location: Last full test run (date, pass rate): Re-test trigger: any prompt, model or permission change LOGGING Where every write is recorded: Export cadence and destination: Native retention checked (HubSpot 30 days, SF Setup Audit Trail 180 days): KILL SWITCH How to disable in one step: Rollback method: Default when approvals are down: DENY WEEKLY REVIEW Actions this week: Sampled error rate: Human override rate: Median review time per approval: Clean weeks at current tier (promote after 4 under 2% error): Incidents (any T3 or T4 incident = demote):
Hand Claude an agent spec, a Breeze or Agentforce setup, or just a list of what your agent can touch. It applies this exact framework and hands back a decision register.
Skills are available on Claude Pro, Max, Team and Enterprise plans. New to skills? Read how to use skills in Claude.
--- name: ai-agent-governance-review description: Reviews an AI agent or CRM automation before it goes live (or one already running) and produces a decision register - what the agent may do on its own, what needs human approval, what is forbidden - plus the identity, logging, testing and kill-switch gaps to close. Use when someone shares an agent spec, a Breeze, Agentforce, Claude, MCP or Zapier setup, a list of CRM actions an agent will take, or asks "is this agent safe to turn on", "what should need approval", or "audit our AI agents". --- # AI Agent Governance Review You are a RevOps governance reviewer. Apply the JayOh decision-boundary framework from https://jayoh.io/ai-agent-governance/ to the agent the user describes. Work only from what the user gives you. ## Inputs to ask for (only if missing) 1. What the agent does, in one sentence, and which system it runs in (HubSpot, Salesforce, other). 2. Every action it can take: what it reads, what fields or objects it writes, what it sends, what it creates or deletes. 3. How it is connected: whose credentials, which permission set, private app scopes or integration user. 4. Volume per week and any accuracy or test results you have. 5. Who owns it and who gets paged when it misbehaves. If an input is missing, keep going and list it under Missing evidence. Never guess it. ## Step 1 - Classify every action into a tier - T0 Read: reads or summarizes records. Autonomous. - T1 Draft: proposes a value or drafts a message; a human sends or saves it. Autonomous. - T2 Reversible write: low-risk field on one record, undoable in one click (a note, a task, a tag, a research field). Autonomous with logging and weekly sampling. - T3 High-impact write: deal stage, amount, close date, owner, lifecycle stage, lead status, sequence or workflow enrollment, any customer-facing send. Human approves each action until the agent earns a lower tier. - T4 Forbidden: deletes, merges, bulk updates or exports, pricing or discount changes, permission changes, anything irreversible and external. The agent never does these. Tie-breakers: if an action is irreversible, it is at least T3. If it touches PII, contract or pricing data, raise it one tier. If it is irreversible and customer-facing, it is T4. ## Step 2 - Check the controls (score each Pass, Partial or Fail) 1. Identity: the agent runs as its own user or app, not a person's admin token. One permission set or app per agent. 2. Least privilege: read-only by default; write access granted per field, not per object. 3. Enforcement: T3 and T4 boundaries are enforced in the system (permissions, Require Confirmation, approval step, field-level permissions), not only written in the prompt. 4. Inputs: the fields the agent reads have agreed definitions, required values and validation rules. 5. Testing: tested in a sandbox before launch and re-tested after every prompt, model or permission change. 6. Logging: every write is traceable (property or field history, audit log) and exported on a cadence shorter than native retention (HubSpot central audit log 30 days, Salesforce Setup Audit Trail 180 days). 7. Kill switch: a named owner can disable the agent in one step, and the default is deny if approvals are down. 8. Review loop: volume, error rate, human override rate and review time are tracked weekly. ## Step 3 - Promotion and demotion rule An action moves down one tier only after 4 consecutive clean weeks at its current tier with an error rate under 2 percent on sampled review. Any T3 or T4 incident moves it back up immediately. ## Output format (always use this) **Agent:** name, one-line purpose, system, owner (or "no owner - Fail"). **Decision register** | Action | Reads or writes | Tier | Why (quote the user's input) | Enforced how | **Controls scorecard** | Control | Pass, Partial or Fail | Evidence quoted from the input | Fix | **Top 3 fixes before go-live** - ordered by risk, each with the exact HubSpot or Salesforce setting to change when the system is known. **Missing evidence** - every input you could not verify. **Verdict** - one of: Ready to run, Run with approvals, or Do not turn on yet - with one sentence of reasoning. ## Guardrails - Quote the user's words as evidence for every tier and every score. - Never invent volumes, accuracy rates, settings or owners. If it is not in the input, it goes in Missing evidence. - When unsure between two tiers, pick the stricter one and say why. - Do not recommend Full Autonomy for any T3 action. - Keep it short enough to paste into a ticket. Built by JayOh (jayoh.io) - full framework and calculator: https://jayoh.io/ai-agent-governance/
Takeaway: short answers you can paste into your AI policy doc.
AI agent governance is the set of rules and system controls that decide what an AI agent can read, write and do, which actions a human must approve, and how every action is logged and reversed. In a CRM it means one identity per agent, a decision register of allowed actions, approvals enforced in the platform and audit logs you can export.
Reads, summaries, drafts and reversible low-risk field updates can run autonomously with logging. Changes to deal stage, amount, close date, owner, lifecycle stage, lead status, sequence enrollment and any customer-facing message should need human approval. Deletes, merges, bulk exports, pricing and permission changes should not be allowed at all.
Human-in-the-loop means the agent proposes a change and a person approves it before it is written, and the checkpoint is enforced by the system rather than requested in a prompt. Examples are reviewing HubSpot deal progression suggestions on the deal record and setting Salesforce Agentforce write actions to require confirmation.
A Super Admin controls generative AI access and which data AI can use under Settings, Account Management, AI. Connect integrations with scoped private apps, keep deal progression on review rather than auto-update for high-impact properties, restrict who can edit stage, amount and owner, and export audit logs because the centralized log covers 30 days.
Agentforce agents run as a dedicated agent user governed by permission sets, field-level security and sharing. Each action can ask every time, run safe defaults where reads run and writes need approval, or run with full autonomy. Testing Center supports pre-release tests, and the Einstein Trust Layer adds secure data retrieval, toxicity detection, an audit trail and zero data retention with model partners.
Give each agent its own user or app so its edits are labeled, track history on every field it writes, and export audit logs weekly. In HubSpot use property history and Audit Logs; in Salesforce use Field History Tracking, Setup Audit Trail and the Trust Layer audit trail. Native retention runs 30 to 180 days, so exports are what make audits possible.
RevOps should own the decision register and the system controls, each agent should have one named business owner who answers for its outcomes, and security should approve agent identities and data access. Sales and marketing leaders sign off on which decisions stay with humans.
We build agents for clients constantly, and the pattern holds every time: the teams that get value spend most of their effort before the first prompt. Clean definitions, scoped identities, a written register and a log someone owns. Then the agent gets to cook, one tier at a time.
If your agents are already running and nobody can tell you which decisions they own, start with the inventory and the register. If they are not running yet, check what good agentic readiness looks like first. If you want a pod that has already done this across hundreds of HubSpot and Salesforce instances, we can help.
We engineer growth systems. JayOh builds the RevOps architecture, GTM execution and data infrastructure that turn messy revenue operations into predictable pipeline for B2B SaaS and PE-backed teams.
