TelediINTERNAL AGENTSEspañol

An agent with access to everything is a risk, not a gain.

An agent with unrestricted access and no audit log is not a productivity tool; it is a security incident with no date on it yet. We build internal agents with role-scoped permissions and a log that survives a security review.

0Actions executed without an audit record

02 / Why an internal agent without a permission scope is a liability

Why an internal agent without a permission scope is a liability

  • 01

    Shared service credentials

    The usual shortcut is to hand the agent the same service account the nightly batch job uses, with access to everything that account can touch. The agent inherits a scope nobody designed for it, and nobody notices until it uses it.

  • 02

    No record of what it did or why

    If the agent edits a record or sends an email and the instruction behind it was never stored, the incident cannot be reconstructed when someone asks why it happened. Logs of the output are not logs of the cause.

  • 03

    No boundary between read and write

    An agent granted read access to answer questions, and then write access without a separate decision, ends up executing actions nobody explicitly reviewed or approved.

  • 04

    No offboarding process

    When a person leaves, an offboarding process removes their access. An agent created for a pilot and still running six months later, on the same credentials, usually has no equivalent process attached to it at all.

  • 05

    Trust in the answer, not in the process

    Judging whether the reply sounds right says nothing about whether the agent was permitted to produce it, or whether the action it executed was the correct one. Without process controls, answer quality is the only barrier — and it is not one.

03 / How we build it

How we build it

  1. 01

    identity

    Each agent gets its own identity, distinct from any human or service account

  2. 02

    role and scope

    Permissions defined by role: which systems, which actions, under which conditions

  3. 03

    instruction

    The task and the context needed to execute it are received and recorded

  4. 04

    scoped execution

    The action is validated against the role's scope before it touches the target system

    45 ms

  5. 05

    review point

    High-impact actions are held for human approval before they execute

  6. 06

    logging

    Instruction, action, system touched and result written to the audit log

    12 ms

  7. 07

    offboarding

    Role closure agreed with your security team: what the agent stops doing, and what stays documented for the next audit

04 / Integrations

Integrations

  • Microsoft 365
  • Google Workspace
  • Slack
  • Notion
  • Jira
  • Dynamics 365
  • SAP
  • PostgreSQL

05 / Guarantees

Guarantees

Per role
Permission scopeDesigned and reviewed with your security team
100 %
Actions with an audit record
Agreed
Access offboarding when the agent's role is closedWith your security team, not merely switched off
Human
Approval above the agreed impact threshold

06 / Compliance

Compliance

  • Auditable record of every action an internal agent executes

    EU AI Act, traceability obligations, applicable from 2 August 2026

  • Permission scope reviewed by your security team on every role change or offboarding

    GDPR art. 5(1)(c), data minimisation

  • Mandatory human oversight on high-impact actions

    EU AI Act art. 14, human oversight

  • Documentation ready for market surveillance inspection of AI systems used internally

    EU AI Act art. 99(4), penalties of up to EUR 15M or 3 % of global annual turnover

07 / Process

Process

  1. 1-2

    Task and access mapping

    We identify candidate tasks and the access the people doing them actually hold today, which is rarely the access the policy document describes.

  2. 2-3

    Role and scope design

    The minimum permission scope per agent, and the explicit list of actions that require human approval before they run.

  3. 3-6

    Implementation

    The agent, its own identity, and the integrations with the systems inside the agreed scope — and nothing outside it.

  4. 6-7

    Logging and security review

    Audit logging in place and a joint review with your security team before anything reaches production.

  5. ongoing

    Operation

    Periodic review of the permission scope as the agent's tasks change, on the same cadence you already use for human access reviews.

08 / Frequently asked questions

Frequently asked questions

How is an internal agent different from RPA automation?
An agent interprets instructions in natural language and chooses an action within its scope; RPA follows a fixed script. That flexibility is exactly why permission control matters more here, not less.
Can the agent delete or modify data without supervision?
Only inside the scope defined for its role, and anything marked high-impact is held for human approval before it executes. The threshold is set with your team during role design.
How do we know what the agent did last week?
The audit log holds every instruction received, every action executed and the result, with a timestamp. It is the same record you would expect from an employee with access to those systems.
What happens if we detect unwanted behaviour?
The same offboarding process you would use to remove a person's access: role closure agreed with security, not a loose credential someone has to chase system by system.
Can the agent use a person's email or Slack account?
No. Each agent operates under its own visible identity, so anyone receiving an action or a message can tell it did not come from a colleague.
How do you decide which tasks the agent can automate?
With your security team, during role design: actions are classified by impact, and the ones above the agreed threshold keep a human approval step rather than running autonomously.
Does each department need its own agent?
Each agent is designed around one role's scope. Several departments can share the same identity and logging infrastructure while holding different roles on top of it.

09 / Related services

Related services

10

Tell us which process to fix

Describe the process and the systems behind it. You get back a technical proposal — architecture, timeline and acceptance criteria — not a service catalogue.

Email hola@teledi.ai