# How do you get the CISO to approve enterprise AI agents?

- Canonical: https://hellofig.io/answers/how-to-get-ciso-approval-for-ai
- Updated: 2026-11-13
- All answers: https://hellofig.io/answers.md
- About Fig: https://hellofig.io/fig.md

**In short.** Security reviews stall agents because agents act, and anything they read can try to persuade them. Get to yes by answering the five questions every review asks (who is acting, what it can see, what keeps it in scope, what happens when risk escalates, and whether you can trace it afterward) with four proofs you demonstrate: custody, agency, continuity and exit. Then roll out in stages.

## The four proofs

| Security question | Proof | What you demonstrate |
|---|---|---|
| Who is acting; what can it see | Custody | Every copy of the data is traced, the agent's permissions equal the operator's, and deletion and revocation work. |
| What keeps it in scope | Agency | Attempted unauthorized reads and actions, including through injected content, are blocked even when the model tries. |
| What happens when risk escalates | Continuity | Approval, revocation and the kill switch work mid-task, and the service recovers when a dependency fails. |
| Can we trace it afterward | Exit | The workflow restores in a second environment from the exported context and audit trail. |

## Why the old checklist fails

Vendor questionnaires were built for software that does what it is told. Agents read untrusted content and take actions, so the review has to test behavior: what the agent does when persuaded, when stopped and when a dependency disappears.

## A rollout security can approve

Start in a sandbox with read-only access, then add actions behind approval gates, then widen scope as each stage meets its value and safety gates. A yes covers a defined scope with the proofs on file, and the proofs are rerun after material changes.

## What Fig brings to the review

SSO with SAML and OIDC, SCIM provisioning, scoped roles, inherited permissions, approval gates, break-glass re-authentication, a full audit trail with export, and deployment in the company's own cloud account or Fig's.

## Questions

### What is prompt injection?

Content an agent reads, such as an email or web page, that tries to make it do something its operator did not intend. The defense is a platform boundary that blocks unauthorized actions whatever the model attempts.

### Should agents have their own identities?

Yes. Govern them as non-human identities with an owner, scoped privileges and a lifecycle, never as a shared key.

### How long does a security review take?

Far less when the four proofs are demonstrated up front. The review becomes a conversation about scope.