Enterprise AI 16 min read

AI agent controls: what 12 platforms document for six buyer controls

We reviewed public implementation documentation for 12 AI agent product families across six buyer controls, retaining product scopes, evidence gaps and source-level limitations.

BriefScript Editorial November 11, 2026

AI agent buyer controls study covering 12 product families, six controls and 72 evidence checks — The Brief Script original documentation research.

AI agent buyers can find documented controls for approving actions, managing credentials and investigating runs. The harder question is what those controls actually cover. A tool approval, a workflow cancellation and an account spending limit can operate at different layers of the same deployment. We reviewed 12 product families against six operational controls, producing a 72-cell evidence register. Nine families had an explicit pre-action human approval mechanism or complete implementation example in the reviewed documentation. Eleven had execution or audit evidence. Six had an operator-callable way to stop an active execution within the selected product surface. Those counts describe our documentation review. They do not measure effectiveness, default configuration or the percentage of the market with a feature. An inaccessible page remains an evidence gap. A credit limit remains a useful commercial control even though it does not meet our deliberately narrower definition of a USD-denominated execution stop. The practical finding is that buying an agent platform does not settle who owns its controls. Buyers need to identify the protected resource, the enforcement point and the person responsible for configuring it.

What we found

Audit evidence was the most consistently documented control, with 11 of 12 product families showing a control-specific mechanism or a complete implementation example. Human approval (9 of 12) and runtime access (8 of 12) followed. Credential governance was documented for 8 of 12 families, with 3 more covered by a buyer-built extension path. Stopping active execution was documented for 6 of 12. The weakest point was the stop on USD-denominated execution: only 1 of 12 families had a specific mechanism, 6 offered a narrower feature, and 5 had no qualifying evidence located in the reviewed sources.

What this study does not show

This is a desk study of public documentation, not a test of how products perform. The sample of 12 product families was selected purposively and is not random or representative of the market. The findings rest on vendor-authored technical documentation, application programming interface references and implementation examples. The research was AI-assisted, with no independent human double coding, vendor confirmation, paid-account inspection or hands-on effectiveness test. The study was not publicly preregistered, and documentation can change after the cutoff date.

What did we examine?

The cohort follows the 12 families in our existing AI agent platform comparison. It includes managed enterprise products and developer frameworks. They are different building blocks, so this study compares documented control surfaces rather than treating them as interchangeable products. We checked runtime access boundaries, credential governance, human approval before an action, execution or audit evidence, stopping active execution, and USD-denominated execution stops. We retained the exact product boundary for every observation. OpenAI means the Python Agents SDK here. Claude means the Agent SDK, not Managed Agents. AgentCore means Gateway, Policy and Runtime, with other AWS agent products excluded from inherited credit. Every cell links to primary source identifiers in the accompanying evidence register. The register contains observations and limitations, rather than a security score.

Control	D documented	B buyer path	A narrower	U unlocated	R restricted
Runtime access	8	0	2	0	2
Credential governance	8	3	0	1	0
Human approval	9	0	1	1	1
Audit evidence	11	0	0	0	1
Stop active execution	6	1	3	1	1
USD execution stop	1	0	6	5	0

D means a documented control-specific mechanism or complete implementation example. B is a general buyer-built extension path. A is a narrower or adjacent feature. U means qualifying evidence was not located in the reviewed source set. R means relevant implementation material could not be inspected. None of A, U or R means the feature is absent or the product is unsafe.

Documentation evidence across six AI agent controls in a cohort of 12 product families — Each bar contains 12 reviewed families. Codes describe documentation evidence, not security effectiveness.

Each bar contains 12 reviewed families. The categories describe evidence, not relative security. Source: The Brief Script evidence register, 10 November 2026.

Which platforms documented each control?

Scoped family	Access	Credentials	Approval	Audit	Stop	USD stop
Microsoft Copilot Studio	D	D	D	D	A	A
Google ADK and managed runtime	D	D	D	D	D	A
Amazon Bedrock AgentCore	D	D	U	D	D	U
Salesforce Agentforce	D	D	D	D	A	U
ServiceNow AI Agent Studio	R	U	R	R	R	U
IBM watsonx Orchestrate	R	D	A	D	U	U
UiPath Agents and Maestro	D	D	D	D	D	A
CrewAI Flows and AMP	D	B	D	D	B	A
OpenAI Agents SDK Python	A	B	D	D	D	A
Claude Agent SDK	D	B	D	D	D	D
LangGraph and LangSmith Deployment	D	D	D	D	D	U
n8n AI Agent workflows	A	D	D	D	A	A

Read the product boundary and claim-level caveat before interpreting a cell. Managed services and SDKs require different amounts of deployment work. There is no meaningful overall winner obtained by adding these letters. ServiceNow accounts for four restricted cells because its relevant live documentation bodies could not be inspected in this environment. IBM’s relevant control-center page also produced an access failure. We did not convert search extracts into positive implementation findings, or convert access problems into missing features. The downloadable dataset preserves all 12 families in every denominator. It also makes the difference between an unlocated mechanism and an inaccessible source visible.

When does human review actually happen?

An approval control should interrupt the path to a sensitive action. A conversation that occasionally asks a person for advice does not establish that boundary. Our reviewed examples include Copilot Studio’s tool confirmation setting, Agentforce’s action confirmation flag, Google ADK’s tool confirmation, and n8n’s human review of selected tool calls. These are configuration points buyers can inspect. They still have scope, language, channel or deployment requirements. (MS1, SF1, GO3, N81) CrewAI illustrates why the exact implementation matters. Its execution hooks documentation includes a pre-tool human approval example that aborts a rejected operation. Its Flow feedback mechanism reviews the output of a method that has already executed. Buyers need to put consequential side effects behind the intended gate. (CR1, CR2) LangGraph’s documented approval pattern places side effects after an interrupt and approval branch. Its resume behavior also matters: the interrupted node restarts, so earlier side effects can repeat. That makes node placement and idempotency part of deploying the documented pattern. (LA3) The buyer’s question is specific: can this action run before this person has approved these arguments? A general claim of human oversight does not answer it.

A proposed AI tool call reaches human approval before execution, while rejection blocks the call — Place consequential side effects after explicit human approval. Illustrative pattern based on sources CR1, CR2 and LA3.

What does a stop button stop?

We found six qualifying active-execution stop mechanisms within the selected surfaces. Their scopes differ. AgentCore documents runtime-session termination. Google’s reviewed cancellation surface is TypeScript. UiPath’s relevant operation is Maestro process cancellation. The OpenAI and Claude SDK examples concern their runtime or streaming interfaces. LangSmith exposes an Agent Server cancel-run API. (AW5, GO5, UI3, OA4, CL4, LA4) We kept narrower mechanisms separate. Ending remaining planned orchestration steps, ending a conversation session and reaching a preconfigured workflow timeout do not establish the same operator control over an active external action. They received A in the relevant cells, rather than being discarded as useless. (MS4, SF5, N85) There is another boundary after cancellation. The LangSmith cancel-run API offers interrupt and rollback actions. That does not establish reversal of a completed payment, email or external database transaction. Buyers need an application recovery design for those side effects. (LA4) Stopping future schedules, interrupting a current run and undoing completed changes are separate acceptance requirements. A product may help with more than one, but a single label should not stand in for all three.

Three AI agent control boundaries distinguish future schedules, active execution and completed external changes — Stopping future work, interrupting a run and recovering completed changes require separate evidence.

Why are spending controls hard to compare?

We used a narrow definition for C6: a USD-denominated execution stop. That definition intentionally separates runtime cost estimates from monthly credits, allocated units, iteration counts and billing alerts. It does not imply those adjacent controls are inferior. One family met that definition in our reviewed sources. The Claude Agent SDK Python reference documents max_budget_usd. It uses a client-side cost estimate, can overshoot, excludes restored historical session totals and resets under the documented clear behavior. It is not a guaranteed ceiling on the customer’s all-in invoice. (CL4, CL5) Microsoft’s reviewed harness documentation describes a monthly Copilot Credit limit with a stop option. UiPath documents configurable consumption enforcement at a tenant’s allocated units. Both are material controls. Their denomination, service boundary and fallback behavior differ from a per-query USD estimate. (MS5, MS6, UI4) An iteration or model-call limit addresses a different dimension. It can constrain runaway loops without fixing a dollar amount across changing model prices, token sizes and third-party tools. n8n’s prepaid Gateway usage is documented for Cloud Starter and Pro from version 2.36.0, rather than Enterprise or self-hosted installations. It also covers a selected billing path rather than every possible customer credential. (GO6, OA5, N86) A buyer should therefore specify the billable resource, the measurement unit, the period, the stop behavior and the treatment of in-flight work. Our data does not establish a guaranteed all-in invoice ceiling for any reviewed configuration.

Do traces establish an audit trail?

Eleven families had qualifying execution or audit evidence in the reviewed material. This was the most widely documented control in this cohort, but the underlying records were not uniform. Copilot Studio’s Purview documentation establishes AI-interaction auditing with configuration and permission requirements. n8n’s external log streaming includes execution and audit categories under an Enterprise scope. Salesforce’s reviewed session-trace export is beta, supports a single session per request and has a 72-hour session-start window. (MS3, N83, SF4) Other qualifying cells establish execution traces or telemetry. They do not automatically establish an immutable administrative ledger, a retention period suitable for a particular business or successful export to the buyer’s systems. The question for a procurement review is whether an investigator can connect an action to the relevant user, credential, tool arguments, approval and outcome. That is an acceptance requirement to test, not a capability we proved by reading a tracing overview.

Who owns access and credentials?

The distinction between platform access and business-resource access is easy to lose. Being allowed to edit an agent does not establish what that agent can do in a database, CRM or payment system. The reviewed Google documentation requires permission on the underlying service as well as registry access. AgentCore Gateway policy is configuration-dependent. Agentforce’s selected agent identity has its own permissions. The relevant protection is the configured runtime identity or policy boundary, not merely the presence of an enterprise administration screen. (GO1, AW1, AW7, SF2) We treated tool exposure conservatively. Attaching tools to a workflow or filtering a tool list can reduce what the model sees. The reviewed material did not, by itself, establish downstream resource authorization for those cells. (N84, OA1) Credential responsibility also varies. A deployment secret store, a named connection and on-behalf-of OAuth can each meet our definition within a specified scope. A security guide that recommends a buyer-operated credential proxy is a different kind of evidence. It describes work the buyer still owns. (LA2, SF3, IB2, CL2) These boundaries are relevant to the broader enterprise AI security program. They should be captured in the deployment design, not left as assumptions attached to a platform logo.

What should buyers ask a vendor to demonstrate?

The next step is an acceptance test against the buyer’s actual architecture. We propose six demonstrations. We did not perform these product tests in this study.

Control	Demonstration to request	Evidence to retain
Runtime access	Attempt a prohibited action with the actual runtime identity	Denial and the policy or resource permission that caused it
Credentials	Revoke a delegated credential and try the relevant action again	Revocation behavior, remaining token lifetime and identity used
Approval	Reject a consequential tool call with realistic arguments	Rejection record and proof that the reviewed action did not execute
Audit	Export the resulting run and its approval decision	Joinable user, tool, decision and outcome records
Stop	Cancel while a slow external tool is active	What stopped, what completed and what recovery remains
Spend	Approach the selected usage threshold with in-flight work	Unit, billing scope, enforcement point and any overshoot

These checks make an AI governance program concrete. They turn a feature discussion into evidence about a particular deployment.

How did we conduct the research?

We selected the cohort purposively from The Brief Script’s existing comparison. The sample is not random or market-representative. It mixes SDKs and managed products because buyers combine them, but that also limits direct comparison. We used vendor-authored technical documentation, API references and official implementation examples. The source register records 63 primary URLs, locators, access mode and the review date. A substantive implementation page was required for a positive finding. Some sources were relevant primarily because they explained a narrower feature or an access limitation. Searches were adaptive at product level. We followed official documentation indexes, searched control terms and alternatives, and examined linked pages. We did not execute a uniform, exhaustive search protocol for every cell. U therefore means unlocated in this reviewed source set, not unavailable anywhere in the product ecosystem. An internal protocol was written before final tabulation. Its amendments are included: C6 was clarified to avoid implying an invoice guarantee; complete implementation examples were made explicitly eligible; and actual search effort and access limitations were disclosed. This was not a publicly preregistered study. The work was AI-assisted desk research. The same assistant performed a second consistency pass over the 72 cells. There was no independent human double coding, vendor confirmation, paid-account inspection or hands-on effectiveness test. Documentation can change after the cutoff. The dataset supports scrutiny and correction. A disputed cell should be resolved by identifying the applicable product surface, source, mechanism and limitation. It should not be resolved by treating a missing public disclosure as a missing security capability.

Where can readers check the sources?

Source identifiers below connect the article to the evidence dataset. Some listed pages explain adjacent features or access limits; inclusion is not a positive feature finding.

MS1 Add tools to a custom agent. End user authentication; ask the end user before running. Accessed 2026-11-10. Opened official technical documentation.

MS2 Copilot Studio security and governance. Authentication and resource access. Accessed 2026-11-10. Opened official technical documentation.

MS3 Use Purview with Copilot Studio. Auditing and AI interactions; permissions and configuration. Accessed 2026-11-10. Opened official technical documentation.

MS4 Generative orchestration. End all topics node and remaining planned steps. Accessed 2026-11-10. Opened official technical documentation.

MS5 Manage usage of GitHub Copilot harness. Agent monthly Copilot Credit limit; Stop usage; alerts. Accessed 2026-11-10. Opened official technical documentation.

MS6 Manage Copilot Studio credits capacity. Allocation, tenant pool and pay-as-you-go. Accessed 2026-11-10. Opened official technical documentation.

GO1 Authenticate to tools and resources. Underlying-service IAM; auth providers; user delegation. Accessed 2026-11-10. Opened official technical documentation.

GO2 Agent Identity integration. Auth manager and preview/version constraints. Accessed 2026-11-10. Opened official technical documentation.

GO3 Human input. FunctionTool require_confirmation; approval and rejection. Accessed 2026-11-10. Opened official technical documentation.

GO4 Cloud Trace integration. Agent/model/tool spans; exporter setup. Accessed 2026-11-10. Opened official technical documentation.

GO5 Cancel a running agent. TypeScript v1.0 AbortSignal and AbortController. Accessed 2026-11-10. Opened official technical documentation.

GO6 Streaming runtime configuration. max_llm_calls scope and run_live limitation. Accessed 2026-11-10. Opened official technical documentation.

AW1 AgentCore Policy getting started. Gateway Cedar policy enforcement example. Accessed 2026-11-10. Opened official technical documentation.

AW2 Obtain credentials. Workload token and credential vault. Accessed 2026-11-10. Opened official technical documentation.

AW3 Harness tools. Client-side tool handling; Harness is outside selected scope. Accessed 2026-11-10. Opened official technical documentation.

AW4 AgentCore observability. Runtime observability and instrumentation. Accessed 2026-11-10. Opened official technical documentation.

AW5 Stop a Runtime session. StopRuntimeSession authorization and termination. Accessed 2026-11-10. Opened official technical documentation.

AW6 Create a payment session. maxSpendAmount covers payments; excluded module. Accessed 2026-11-10. Opened official technical documentation.

AW7 Gateway inbound authorization. Authorization modes; authenticate-only is not policy enforcement. Accessed 2026-11-10. Opened official technical documentation.

SF1 Agent Script action reference. require_user_confirmation. Accessed 2026-11-10. Opened official technical documentation.

SF2 Agent Script blocks. default_agent_user and permissions. Accessed 2026-11-10. Opened official technical documentation.

SF3 Connect MuleSoft tools to Agentforce. Named Credential and user access setup. Accessed 2026-11-10. Opened official technical documentation.

SF4 Export Agentforce session tracing data. Beta limitations; single session; previous 72 hours. Accessed 2026-11-10. Official HTML fetched locally; body and limitations inspected.

SF5 Agent API external session reference. End session; active/busy session semantics. Accessed 2026-11-10. Opened official technical documentation.

SN1 AI agent security implementation. Relevant security/role masking page. Accessed 2026-11-10. Restricted review: search extract found; live document body unavailable.

SN2 In-product agentic AI. Relevant supervision, workflow history and cancellation page. Accessed 2026-11-10. Restricted review: public URL returned unsupported content; local retrieval was a shell.

IB1 Security Control Center agent access. Relevant agent access page. Accessed 2026-11-10. Restricted review: HTTP 403; no substantive implementation finding awarded.

IB2 Workday SSO connection concepts. OAuth on-behalf-of token exchange. Accessed 2026-11-10. Opened official technical documentation.

IB3 Build an agentic workflow with no code. User activity forms and conditional branching. Accessed 2026-11-10. Opened official technical documentation.

IB4 Export watsonx Orchestrate agent trace. Trace export API and ADK 2.13 or later. Accessed 2026-11-10. Opened official technical documentation.

IB5 watsonx Orchestrate documentation index. 2.x index link; linked content returned Site Unavailable. Accessed 2026-11-10. Index opened; linked 2.x body unavailable in local retrieval.

UI1 UiPath tool guardrails. Before/after tool Block and Escalate; trace records. Accessed 2026-11-10. Opened official technical documentation.

UI2 Orchestrator connections. Reusable OAuth/API key connections. Accessed 2026-11-10. Opened official technical documentation.

UI3 Maestro process overview. Pause versus Cancel active process. Accessed 2026-11-10. Opened official technical documentation.

UI4 Tenant consumption enforcement. Per-service tenant Stop at 100% of allocated units. Accessed 2026-11-10. Opened official technical documentation.

CR1 CrewAI execution hooks. Deny and human approval examples; HookAborted; fail-open exceptions. Accessed 2026-11-10. Opened official technical documentation.

CR2 Human feedback in Flows. Feedback on completed method output; routing. Accessed 2026-11-10. Opened official technical documentation.

CR3 CrewAI tracing. Enable tracing and consent to AMP export. Accessed 2026-11-10. Opened official technical documentation.

CR4 MCP security. Authentication, secrets and least-privilege recommendations. Accessed 2026-11-10. Opened official technical documentation.

OA1 OpenAI Agents SDK MCP. Tool filtering; authorization headers; least privilege. Accessed 2026-11-10. Opened official technical documentation.

OA2 Human-in-the-loop. needs_approval; state approval/rejection; sticky decisions. Accessed 2026-11-10. Opened official technical documentation.

OA3 Agents SDK tracing. Default traces; sensitive payload settings and export. Accessed 2026-11-10. Opened official technical documentation.

OA4 Agents SDK results. RunResultStreaming.cancel and stream cleanup. Accessed 2026-11-10. Opened official technical documentation.

OA5 Running agents. max_turns and MaxTurnsExceeded. Accessed 2026-11-10. Opened official technical documentation.

CL1 Claude Agent SDK permissions. Deny evaluation order; allow rules can bypass callback. Accessed 2026-11-10. Opened official technical documentation.

CL2 Secure Agent SDK deployment. Buyer-operated proxy and credential injection. Accessed 2026-11-10. Opened official technical documentation.

CL3 Handle approvals and user input. Human allow/deny callback examples. Accessed 2026-11-10. Opened official technical documentation.

CL4 Agent SDK Python reference. interrupt streaming mode; max_budget_usd. Accessed 2026-11-10. Opened official technical documentation.

CL5 Track cost and usage. Client estimate; budget overshoot and reset scope. Accessed 2026-11-10. Opened official technical documentation.

CL6 Observability with OpenTelemetry. CLI exports; beta spans; identity and payload flags. Accessed 2026-11-10. Opened official technical documentation.

LA1 Custom authentication. auth.on owner filter; secure user token storage. Accessed 2026-11-10. Opened official technical documentation.

LA2 LangSmith data plane. Secrets store for environment secrets. Accessed 2026-11-10. Opened official technical documentation.

LA3 LangGraph interrupts. Human approval example; resume restarts node; side effects. Accessed 2026-11-10. Opened official technical documentation.

LA4 Cancel run API. interrupt and rollback actions. Accessed 2026-11-10. Opened official technical documentation.

LA5 LangSmith observability. Execution traces and inspection. Accessed 2026-11-10. Opened official technical documentation.

LA6 LangSmith pricing. Reviewed pricing surface; no qualifying run USD stop established. Accessed 2026-11-10. Opened official technical documentation.

N81 Human review for AI tool calls. Approve or deny before tool execution. Accessed 2026-11-10. Opened official technical documentation.

N82 External secret stores. Encrypted credentials and Enterprise external vaults. Accessed 2026-11-10. Opened official technical documentation.

N83 Stream logs to external systems. Enterprise event streaming; execution and audit categories. Accessed 2026-11-10. Opened official technical documentation.

N84 Tools Agent node. Connected tools and max iterations. Accessed 2026-11-10. Opened official technical documentation.

N85 Configure workflow timeouts. Soft timeout versus separate-process termination. Accessed 2026-11-10. Opened official technical documentation.

N86 Use Gateway credits. Prepaid Gateway scope; Cloud Starter/Pro from 2.36.0. Accessed 2026-11-10. Opened official technical documentation.

N87 View all executions. Execution status and retry; operator-stop details not established. Accessed 2026-11-10. Opened official technical documentation.

Evidence matrix showing six buyer controls for 12 AI agent product families with documentation gaps retained — Read exact product scopes and limitations in the dataset. A, U and R do not mean missing or unsafe.

Codes: D is a documented control-specific mechanism or complete implementation example. B is a general buyer-built extension path. A is a narrower or adjacent feature. U means qualifying evidence was not located in the reviewed source set. R means relevant implementation material could not be inspected.