What AI agent platforms disclose about permissions

When an AI agent can send email, update records or run code, the first question a buyer should ask is not how clever it is. It is what the agent is allowed to touch, who has to say yes before it acts, and what record it leaves behind. Most of those answers live in documentation, long before anyone signs a contract or runs a pilot.

So we checked. On 16 October 2026 we read the official public documentation of ten agent platforms and scored each one against a ten-point rubric covering permissions, approvals, logs, retention, admin controls, revocation, third-party risk, prompt injection and security disclosure. This is a document review, not a product test. We did not sign in, build an agent or try to break anything. Every score is linked to the page it came from, and the full evidence table is published alongside this article. If agents are new to you, start with our explainer on what AI agents are and how they plan and use tools.

What we reviewed, and what we did not

We picked ten platforms that businesses commonly use or evaluate for building or running agents. They cover chat-style assistants, enterprise suites, automation tools and developer frameworks. For each vendor we reviewed one named product, because one company's documentation can describe several agent products with different controls.

Two products moved while we were reading them. OpenAI's help page for ChatGPT agent now opens with the line "ChatGPT agent is no longer available" and points readers to ChatGPT Work, so we scored Work.[1] Zapier's agent help pages carry a note that "Zapier is moving Agents to AI by Zapier".[2] We scored the pages as published that day. A buyer reading them a month later may find different text.

We did not use third-party write-ups, sales decks, analyst reports or anything behind a login. We also did not judge whether a control is good, only whether the documentation describes it.

The rubric, fixed before scoring

We wrote the rubric down before opening any vendor's documentation, and did not change it during scoring.

Each cell gets one of three scores. Documented means a specific statement that meets the definition. Partial means the topic is mentioned but the statement is general, limited to part of the product, or a capability without guidance. Not found means we could not locate it using our procedure.

The procedure was the same for every platform. We started at the product's documentation home and its security, permissions and admin pages, followed links within the vendor's own domains, and reviewed up to about eight pages per platform. Any cell still at Not found after that got at least one web search restricted to the vendor's domains before we finalised it. We recorded one best URL per cell, with a short note or quotation. For the scoring rules in full, see the rubric file published with the evidence table.

Results: broad coverage, uneven depth

● Documented · ◐ Partial · ○ Not found. Each cell links to a source in the evidence table.

Across 100 cells, 86 were Documented and 14 Partial. Glean was the only platform Documented on all ten. Anthropic, Google, LangChain and ServiceNow each had a single Partial. OpenAI and Zapier had three each.

These are counts of written disclosure, not security ratings. A platform can document a weak control clearly and score well. Another can run a strong control it barely describes and score worse. The table tells a buyer where the written answers are, and where to start asking questions.

AI Chronicle

Five findings

1. Nothing was missing, but four answers were hard to find

After the first pass through each platform's documentation, four cells were still at Not found. All four turned up when we ran the domain-restricted search our procedure required.

• LangChain, prompt injection. The framework's security policy does not use the term. Its Deep Agents sandbox page does, warning that sandboxes "don't protect against context injection".[3]
• Glean, third-party risk. The background-agents security page talks about untrusted inputs, not tools. The MCP Gateway page lists "Unvetted sources" and "Credential exposure" as risks of unmanaged MCP servers.[4]
• n8n, revocation. The credentials page in the docs covers creating and editing. The step for withdrawing access is on n8n's legal security page, which says deleting an OAuth grant inside n8n "doesn't revoke n8n's access" to the third-party account.[5]
• Zapier, third-party risk. The agent help pages say nothing about it. A help article on the MCP Client integration, which works in Zaps and Agents, says to "only connect to remote MCP servers you trust".[2]

That is the strongest practical lesson in this review. The answers usually exist, but not always where a buyer reading the agent docs would look. "Absence from the docs" and "absence from the agent section of the docs" are different findings. The n8n case also shows why the detail matters: removing a credential in one system does not always cut access in the other.

2. Least privilege and third-party risk are the thinnest areas

Two criteria fall well below the others: least-privilege guidance (6 Documented, 4 Partial) and third-party tool risk (5 and 5).

On least privilege, the gap is usually between offering a control and telling customers to use it. Zapier's security page shows that admins can "allow an app but limit its actions", but we found no advice to grant the minimum.[2] Google's Gemini Enterprise security overview advises granting powerful workforce-pool roles only to administrators "who absolutely require them", which concerns admins rather than agents.[6] n8n has a least-privilege guide for one connector, SharePoint. Claude Code recommends project-specific permission settings and regular audits without stating a minimum-access rule.[7]

The Documented cells are often direct. Salesforce tells customers to "Configure running users with minimum permissions required for the agent's defined scope".[8] LangChain's security policy says to "Scope permissions specifically to the application's need".[3] Glean's guidance for background agents says to "Scope each write tool to the minimum permissions and resources required".[4]

“Assume everything listed in agent configuration is reachable through prompt manipulation, even if the agent wasn’t designed to use it.”

— Salesforce, Trust for the Agentic Enterprise, Well-Architected Framework (accessed 16 October 2026).[8]

That sentence explains why least privilege matters more for agents than for most software. An agent's real permission boundary is whatever it can reach, not whatever it was designed to do.

Third-party risk follows the same split. Anthropic says plainly that it reviews connectors for its directory "but does not security-audit or manage any MCP server".[7] n8n calls community nodes "unverified code from a public source" with "full access to the machine that n8n runs on".[5] Microsoft's Copilot Studio MCP page instead says that when you connect a non-Microsoft product, "you're responsible for the tools and resources you access".[9] That moves the responsibility to the customer, but it does not describe the risk. OpenAI notes that data shared with apps is handled under each app's own terms. ServiceNow says external agents need properly scoped credentials. Both count as Partial.[1][10]

AI Chronicle

3. Every platform documents approval, but defaults differ

Human approval was the only control, apart from a disclosure route, that all ten platforms documented. What happens when nobody changes the settings varies.

• Approval by default. Gemini Enterprise says that for actions imported from a custom MCP server, "By default, all calls to any action require confirmation from the user".[6] Glean's write tools need confirmation unless an admin makes a tool eligible and a builder switches confirmation off.[4] OpenAI says ChatGPT "is designed to request confirmation" before consequential actions such as payments, and its site-access default is to ask.[1]
• Approval off by default. In Copilot Studio, the tool setting "Ask the end user before running" is "set to No by default".[9] Gemini Enterprise's own list of third-party connector actions includes an Asana action that creates tasks "immediately without visual preview or asking for confirmation".[6]
• A model approves instead of a person. Claude Code's documented starting mode for interactive terminal and VS Code sessions is auto mode, in which "A separate classifier model reviews actions instead of you". Its manual mode asks before edits and commands.[7]
• Approval by instruction. Zapier documents adding a line to the agent's instructions asking it to wait for confirmation, or a Human in the Loop step when the agent runs inside a Zap.[2] Salesforce warns that approval requests in instructions "are recommendations within the reasoning process" and that mandatory oversight belongs in Flow checkpoints outside the agent.[8]
• Approval per tool. n8n, LangChain and ServiceNow let builders mark individual tools for human review, interrupt or supervised execution.[5][3][10]

All of these count as Documented under our rubric, because each describes a mechanism. For a buyer, the useful question is not "is there an approval step?" but "which actions does it cover when I first switch the agent on, and who can turn it off?"

4. Logs exist, but often behind a setting, an add-on or a plan

Nine of ten platforms document a record of individual agent actions. The catch is that many of these records are optional.

Salesforce's Agentforce Session Tracing, which logs turn-by-turn actions, is "off by default", and its Event Monitoring data is kept for one day unless the customer has Shield or the Event Monitoring add-on.[8] Claude Code's audit data is OpenTelemetry events, which the customer has to enable and export.[7] n8n log streaming and LangSmith audit logs are Enterprise features.[5][3] Glean exports agent traces "through tool calls and LLM interactions" to an observability platform the customer runs.[4]

Copilot Studio was the one Partial. Its Purview audit page lists administrative and maker changes and a user-interaction event. It says the Audit solution's records include "only the transcript thread ID", not the conversation, and we did not find a description of individual tool-call records there.[9] OpenAI's connected-apps page says "All app calls are logged" in its Compliance Logs platform. The pages we read did not say how cloud-browser steps are logged. The retired ChatGPT agent page had said individual agent actions would not appear in Compliance API logs.[1][11]

A log you have to switch on is not a log you will have on the day something goes wrong. Our accountability analysis explains why that record matters once an agent has acted.

5. Retention periods are stated, and they vary widely

Eight platforms state a period or a customer-set control for agent data. The numbers are not comparable without care, because they cover different things: chat history, transcripts, traces or event logs.

Short retention protects privacy. It also limits investigation. A one-day event log or a 14-day trace window can expire before a problem is noticed. A buyer should decide how long they need to keep evidence of agent actions, then check whether the default meets that need or whether it costs extra.

Limits of this review

Absence from the docs is not absence of the feature. A Partial score means we did not find a fuller statement. The feature may still exist, or may be described somewhere we did not look. We ran the extra domain search only for cells still at Not found. Partial cells did not get that extra step, so some may be understated.

Presence in the docs is not proof the feature works. We did no hands-on testing. A Documented cell shows that the vendor describes a control, not that it works as described, applies to every plan or is switched on by default.

One day, one reading. Documentation changes often. Two of the ten products were being renamed or replaced on the day we read them. Every cell reflects the page on 16 October 2026, Pakistan Standard Time.

Scope choices matter. We reviewed one product per vendor. Several vendors offer other agent products with different controls. Some evidence comes from pages for a related surface, such as a vendor-wide security page or an integration used by agents. The evidence table notes where.

Access limits. Salesforce Help articles did not render for our automated fetcher, so Salesforce was scored mostly from its official architecture guidance. That may explain its two Partial cells. ServiceNow's documentation site is a JavaScript application, so we read the same pages from ServiceNow's official GitHub documentation copy and cite the canonical servicenow.com URLs.

Judgment calls. Some boundaries, such as when a responsibility statement becomes a risk warning, needed judgment. We applied the same rule across platforms and recorded the wording behind each call, so readers can disagree with a specific cell.

A worked example: a buyer uses the rubric

This example is hypothetical. The firm, platforms, weights and answers are invented to show the method. They are not findings from this review.

Imagine a 40-person accounting firm with two platforms on its shortlist for an agent that drafts replies to supplier invoice queries and flags exceptions in its finance system. Call them Platform A and Platform B. The firm's operations lead has an afternoon, not a security team.

Step 1: decide which criteria are must-haves. The agent will read invoices and write notes into a finance system, so the lead marks four criteria as gates: human approval (C3), action logs (C4), revocation (C7) and retention (C5). The rest count, but a Partial is acceptable if the vendor answers a follow-up question.

Step 2: read the docs against the rubric. The lead spends about an hour per platform, starting from the security and admin pages and recording one URL per criterion. Platform A documents per-tool approval but sets it off by default. Platform B requires confirmation for write actions by default. Both document action logs, but Platform B's are only on its Enterprise plan.

Step 3: turn every Partial into a written question. Platform A is Partial on retention: its agent page links to a general privacy policy. The lead emails: "How long are agent run records, including tool inputs and outputs, retained on our plan, and can we change it?" Platform B is Partial on third-party risk, so the question is: "Which connectors in your catalogue are built and maintained by you, and which by third parties?"

Step 4: check the defaults, not just the features. For each gate criterion, the lead writes down what happens if nobody changes a setting. Platform A would let the agent write notes without confirmation until someone switches approval on. That becomes a launch checklist item, not a reason to reject it.

Step 5: test before trusting. The rubric only narrows the field. Before any live data, the firm runs both agents in a sandbox with fake invoices. It checks that the approval prompt appears for every write, that the log shows each tool call, and that disconnecting the finance system really stops the agent. Our guide to building a first agent without code covers that staged rollout, and the invoice-exception agent tutorial applies it to this exact job.

The output is a short decision record: the gate criteria, the URL behind each answer, the vendor's written replies to the Partials, and the settings the firm changed before launch. That record is also what the firm will need if an agent action is ever questioned.

How to read a vendor's documentation quickly

Some habits from this review apply to any platform, including ones not in our table:

• Start with security, admin and permissions pages, then search. Agent overview pages rarely carry the detail. Four of our answers turned up only through a targeted search.
• Look for the default. "You can require approval" and "approval is required" are different statements.
• Note the plan. Several logging and access-control features are limited to enterprise tiers.
• Check what revocation actually revokes. Disconnecting inside the agent platform may not revoke the grant in the connected app.
• Separate what the vendor promises from what you must do. Salesforce, Microsoft and Anthropic all frame parts of agent security as the customer's responsibility.

For how failures show up once an agent is running, see why AI agents fail, and how to diagnose the failure. For the gap between a polished demo and a governed deployment, see what AI agent demos leave out. Our profiles of LangChain's role in AI agent development and of Glean and the workplace AI search problem give context on two of the companies reviewed here.

Questions readers commonly ask

Does a high score mean a platform is safer?

No. The score counts written disclosure against ten criteria. It says nothing about how well a control works, how often it fails or whether it is turned on in your account. Use it to find where to look and what to ask, not to rank security.

Why is there no "Not found" anywhere in the results?

Four cells started as Not found and changed after a domain-restricted search found the answer elsewhere in the vendor's documentation. We report that because it shows how scattered the material is, not because every platform is complete. Partial cells did not get the extra search, so the true picture may be slightly better than the table shows.

Why did you score ChatGPT Work rather than ChatGPT agent?

On the day of review, OpenAI's ChatGPT agent help page said the product "is no longer available" and pointed to ChatGPT Work. We scored the current product. Where the retired page said something relevant, such as how agent actions appeared in compliance logs, we mention it as context and do not count it.

Can I reuse the rubric?

Yes. The criteria, scoring definitions and procedure are published with the evidence table. Keep the rubric fixed before you start, record a URL for every cell, and date your reading. If you add criteria for your industry, such as data residency, add them before you begin.

Will you update the scores?

The table is a dated snapshot. We would rerun the same procedure rather than edit individual cells, so that scores stay comparable. Check the date on any score before relying on it.

The next step

Disclosure tells you what a vendor says it provides. It does not tell you who answers for an agent's action when something goes wrong. Read who is accountable when an AI agent acts next. It turns the logs, approvals and permission registers in this rubric into a chain of responsibility.

Related reading: Can AI research assistants substantiate their claims? · Build an invoice-exception investigation agent

About these sources

All pages were accessed on 16 October 2026 (PKT). Each footnote names the main pages used for that platform. The complete cell-by-cell evidence, with one URL and a note or quotation per cell, is in AC059_Evidence_Table.csv, and the rubric is in AC059_Rubric_Preregistered.md. Quotations are exact from the fetched pages. Vendor documentation shows what a vendor describes, not independent proof that a control works. The accounting-firm example is hypothetical.

Related reading

• Build an invoice-exception investigation agent