What controls should be considered before allowing an AI agent to execute an enterprise action?

Before an AI agent can perform an enterprise action, organizations should determine whether the action is authorized, necessary, and appropriate for the requested business task. Important controls include authentication, authorization, least-privilege permissions, input validation, business-rule enforcement, and protection of sensitive data. Higher-impact actions such as deleting records, changing permissions, approving transactions, or sending external communications may require explicit human approval. Audit logging, rate limits, monitoring, and rollback or recovery mechanisms should also be considered. What controls would you put in place before allowing an agent to move from recommendation to execution?