Result

Per-action policy with evidence

Key path: 1b, 5b, 7b

In short: when auditors ask why an agent did something, you need a policy decision for each action and its purpose, recorded as evidence. Choose tools with deterministic policy, a single audit trail of calls and approvals, and exports an auditor can read without your engineers.

Identification

Your autonomous agents are known, but regulators or auditors need proof of each decision. You add per-action, purpose-aware policy with an evidence trail.

Field marks: what does this look like in practice?

• You operate in a regulated sector.
• Audit findings mention agents or service accounts.
• Logs show calls but not the policy that allowed them.

What should I require from a product?

1. Each action is evaluated with its purpose, not only the identity.
2. Policy outcomes are deterministic and reproducible.
3. Policies can be tested against real past sessions before going live.
4. Tool calls, decisions and approvals share one audit trail.
5. Evidence exports are readable by auditors.
6. Risky actions can require a named approver.

Which products fit?

Listed by fit to the requirements above, using each vendor's public material. This is not a ranking.

What is this result confused with?

• Workload identity and secretless access: Pick that when removing secrets is the goal and audit is secondary.
• Per-action approval alongside Okta: That one is for agents acting for Okta users.

What does your identity provider already cover?

• Entra Identity Governance covers on-behalf-of agents; per-action human approval was not found. What is Microsoft Entra Agent ID, read 2026-11-03

An agent governance layer runs alongside your identity provider, never instead of it.