AI agents in SMEs: where to put the person who checks when the AI works for you, and who can stop it

Talk about AI agents mostly centres on which tool is safest. The useful question is a different one: where should a person who checks sit, without becoming the bottleneck for everything.

With an assistant it is simple: you read and decide. An AI agent, instead, does. It opens files, browses, writes on your behalf, calls company systems. Control no longer sits only at the end. It has to be placed along the work.

One owner described his current solution to us like this: a person who acts as a filter, so that day-to-day operations never reach him. When a system starts doing part of that work, the question changes: who answers for what the system does?

Where do I put the human when AI works for me?

There is not one single point. There are three, and each answers a different question.

Before, during, after

1. Before: what it can touch. The minimum permission for each agent: which files, which accounts, which systems.
2. During: where it stops and asks. Checkpoints that block the agent until a person answers.
3. After: who verifies the output. No result leaves the company without someone having checked it.

Pietro Landri, who works with several agents, describes the checkpoints like this:

“three or four human in the loop […] ask you blocking questions” - Pietro Landri, diagnostic session of 28 September 2026 (translated from Italian)

And Fabio Armellini describes his way of working like this:

“I do, I verify and I check” - Fabio Armellini, call of 22 October 2026

The practical rule: the harder an action is to undo, the closer the checkpoint must be.

Who can stop it, and how fast?

According to the Cloud Security Alliance, cited by TechTarget, about 58% of organisations say they monitor their agents. Only 37% can stop one when something goes wrong. Watching is not stopping.

NVIDIA says so on its agent safety page. Prompts and frameworks influence what an agent tries to do. Runtime controls enforce what it is allowed to do. The controls exist. Someone must have decided the boundaries.

The four questions to ask in your company

• Which agents and tools that act on their own, with access to data or systems, are already running? (Not only the approved ones: see shadow AI.)
• Which files, accounts and systems can each one access?
• Who can stop it, and how fast?
• Who decided these permissions, and when are they reviewed?

What if permissions change while the agent is working?

From the audit carried out with Trail of Bits, published on 21 September, one example is worth more than many pages of policy. If access to memory was active at the start and the operator switched it off midway, the run could keep reading memory until the end.

Translated for an owner: you had revoked a permission, but the agent already at work did not know. The project fixed the problem. The lesson stays: a permission is not a decision made once. It is a condition to check for as long as the agent is acting.

The risk is not that the agent answers badly. It is that it acts, with permissions nobody decided.

What do the security data really say?

The OpenClaw project publishes its numbers on its security page. They are data declared by the project, and we cite them as such. Since January 2026, 1,799 reports have come in, more than half closed without an advisory because they were invalid, duplicates or expected by design. That leaves 722 issues fixed and published, 39 with a CVE, and 14 confirmed critical, all fixed and disclosed.

The version curated by NVIDIA is not immune. CVE-2026-65105 describes a NemoClaw inference server reachable without authentication, in versions up to 0.0.25.

None of these data says “avoid these tools”. They say something more useful: security is a process, and even the most carefully built tools still need someone to govern them.

Common mistakes

• Giving the agent the same access as the user “for convenience”.
• Choosing the tool by the demo and not by the permissions.
• Monitoring logs with nobody who has the power to switch it off.
• Treating the permission as a one-off decision.

What do I do this week?

1. List the agents and assistants with access to files or systems.
2. For each one, write down the minimum permission it really needs.
3. Decide where it stops and asks for confirmation: actions that are hard to undo come first.
4. Name one person who can stop it, and how, plus a review date, monthly at the start.

The framework of rules that apply to those who use AI is in the article on the AI Act delay. The company’s liability is in the piece on Legislative Decree 160/2026 (D.Lgs. 160/2026). To find out which AI tools your team already uses, start from the tools register. To see where you stand today there is the SME diagnostic; to build the system, the For Companies path.