Governing AI agents in ECM: Who is really in control?

In my previous article, M-Files AI: From Intelligent Metadata to AI Agents, I explored how AI in Enterprise Content Management has evolved.

We have progressed from automatically classifying documents and suggesting metadata, to AI that can understand information, answer questions and reason about business context. Increasingly, it can also perform tasks.

This evolution is exciting!

Imagine an AI agent that can identify an expiring contract, retrieve the relevant information, check the renewal conditions, prepare a notification and initiate the renewal process.

Or an agent that detects an incoming invoice, checks it against the corresponding purchase order, identifies discrepancies, and routes it to the appropriate person for approval.

These are not just scenarios involving search or classification. They are examples of AI interacting with business processes and enterprise information.

However, before giving AI agents more responsibility, there is an important question we should ask: Who controls what an AI agent can do?

Once an AI agent can act on enterprise content, the discussion is no longer only about AI capabilities. We are now discussing governance.

And in ECM, governance is not an option.

From understanding information to acting on it

Traditional ECM solutions rely on clearly defined governance mechanisms.

These mechanisms determine who can access documents, modify metadata, approve contracts and delete information. Workflows, permissions and audit trails establish the framework within which employees interact with enterprise content.

AI agents introduce a new type of participant.

Unlike traditional automation, an AI agent can interpret context, evaluate information, make decisions based on instructions, and carry out actions.

Consider an employee asking: “Find all contracts due for renewal within the next three months and prepare a notification.”

A traditional search returns a list of contracts. An AI agent could go further:

• Identify relevant contracts and read their renewal conditions.
• Retrieve associated customer information.
• Identify the responsible account managers.
• Prepare personalized notifications.
• Create tasks or initiate a workflow.

The difference is significant. The agent is no longer simply retrieving information. It is interacting with the business environment.

How do we ensure that an AI agent only performs authorized actions, using information it is allowed to access, while remaining accountable and traceable?

I see three fundamental areas that need particular attention.

1. Permissions: An AI agent should not become a superuser

In a traditional ECM environment, access rights tend to be relatively straightforward. Users are granted permissions based on their roles and responsibilities.

However, AI agents complicate this model.

Consider, for example, an agent assisting employees in identifying customer contracts. Should it return every contract in the repository?

Of course not. It should respect the same access restrictions as the employee who requested its help.

There are two common approaches to managing permissions:

Acting with the user’s permissions

The agent operates within the security context of the employee who initiated the request.

If an employee cannot access a confidential contract through the ECM interface, the AI agent should not be able to retrieve it on their behalf.

Acting with dedicated service permissions

Some agents operate autonomously or execute scheduled processes without every task being initiated by a specific user.

In this case, they may require a dedicated technical identity that has access to the necessary information and operations for their responsibilities.

For instance, an agent that monitors contract expiration dates needs access to the relevant contract information, but not to the entire repository.

The biggest mistake would be to grant an AI agent broad administrative permissions simply because it needs to perform various tasks.

We should distinguish between two types of permissions:

• Information access: What content can the agent read?
• Operational access: What actions can the agent perform?

The fact that you are allowed to read a contract does not automatically mean that you are allowed to modify, approve or delete it.

An AI agent should have the minimum permissions necessary to perform its assigned responsibilities.

2. Auditability: Every action needs a trace

The second challenge is auditability.

In traditional ECM, important operations are expected to be traceable.

Who created a document? Modified its metadata? Who approved it? When did its workflow state change?

Now imagine an AI agent processing hundreds of invoices automatically.

It identifies suppliers, extracts invoice information and associates invoices with purchase orders, then routes them for approval.

Everything works perfectly until someone discovers that an invoice has been associated with the wrong purchase order.

How can we reconstruct what happened?

A simple record stating that the invoice metadata was updated by the AI agent is not sufficient.

We need to understand the chain of events.

At a minimum, an appropriate audit trail should capture the following:

• Identity: Which agent performed the operation? Which version was running? Was the agent acting on behalf of a user or through a service account?
• Context: What documents, objects and metadata were used?
• Instructions: What task was the agent asked to perform?
• Decision: What did the agent decide to do, and what information supported that decision?
• Action: What exactly changed in the ECM system?
• Validation: Was the action executed automatically or approved by a human?

Not every step in the internal reasoning process of a generative AI model needs to be stored. The important thing is to have sufficient evidence to reconstruct and explain the business decision and its consequences.

Another important issue is accountability.

Who is responsible when an agent makes a mistake? The person who configured it? The employee who initiated the task? Or the administrator who granted the permissions? Or the business owner responsible for the process?

These responsibilities must be defined before deployment.

Automation must never become a way to make accountability disappear.

3. Human validation: Not every decision should be automatic

The third challenge is deciding how much autonomy to give an AI agent.

For example, updating a missing metadata field is not the same as approving a contract. Similarly, creating an internal notification is not equivalent to sending a contractual commitment to a customer.

The level of autonomy should therefore depend on the potential consequences of an action.

I would distinguish four levels:

Observe and recommend

The agent reads the information, identifies any potential issues, and suggests appropriate actions. No changes are made to the ECM system.

For example, it can identify contracts approaching expiration and present them to the responsible employee.

Prepare and request approval

The agent prepares an action, but waits for human validation before executing it.

For example, this could involve preparing a contract renewal notification for the account manager.

Execute within predefined boundaries

The agent automatically performs specific actions when clearly defined conditions are met. Ambiguous situations or exceptions are escalated to a human operator.

For example, metadata is updated when extracted information matches an existing validated business object.

Autonomous execution

The agent carries out entire business processes within explicitly defined permissions and constraints.

For example, they process standard internal document requests without requiring individual approval for every operation.

These levels do not necessarily represent steps that every organization must follow. Different levels can coexist, depending on the business process.

For example, an organization might allow autonomous metadata enrichment while requiring human approval for contract modifications.

The key is to make validation risk-based.

Consider the business impact, reversibility, confidence in the information, sensitivity, and potential financial or legal consequences.

The greater the impact of an action, the stronger the validation and control mechanisms should be.

Human validation must also be meaningful. For example, an approval button that employees click without understanding what the agent has prepared is not effective governance.

4. Governance starts before deployment

Permissions, auditability and human validation must not be considered as individual technical features. Rather, they must form part of a broader governance approach.

In my experience as an ECM consultant, information management problems often stem from issues beyond the scope of the software itself. Rather, they stem from unclear responsibilities, inconsistent processes and poorly defined information structures.

AI agents will not magically solve these problems. In fact, they can exacerbate them.

Before introducing an agent, I would ask five questions:

• What is the agent responsible for? Its purpose should be clearly defined. ‘Manage contracts’ is too broad. ‘Identify contracts approaching expiration and prepare renewal notifications’ is much more precise.
• What information does it need? Access should be limited to the information required for the task at hand.
• What actions can it perform? Reading, creating, modifying, approving and deleting are all different operations that require explicit authorization.
• What happens when something goes wrong? The agent must know when to stop, request additional information, or escalate the situation to a human operator.
• Who owns the agent? Someone must be responsible for its configuration, testing, deployment, monitoring, and eventual retirement.

An AI agent should be treated as a governed component of the information system rather than as a one-off experiment whose ownership is unclear after deployment.

5. ECM becomes the control environment for AI agents

There is a key reason why ECM platforms are particularly relevant to this discussion.

An AI agent requires more than just access to documents. It also requires business context.

Consider a contract. To understand its business meaning, you need to do more than just read its content:

• Which customer is involved?
• Which project does it belong to?
• Who is responsible for the relationship?
• What is its current status?
• Which workflow governs its approval?
• Who is authorized to make decisions about it?

This is where the value of a well-designed ECM system becomes apparent.

The information model provides context. Relationships connect business objects. Workflows define processes. Permissions establish boundaries. Audit trails provide traceability.

Together, these elements create an environment in which AI agents can operate with a better understanding of the organization.

However, the presence of governance mechanisms in an ECM system does not automatically ensure that AI agents will respect them.

The integration between the agent and the ECM platform must enforce the relevant security and business rules. An agent should not bypass the ECM security model by using a technical account with excessive privileges or an alternative integration.

The ECM platform should not simply be a repository that AI agents read from. It should be part of the environment that controls what they can access and do.

Conclusion: Autonomy requires governance

AI agents represent a significant evolution in enterprise content management.

We began by helping systems understand documents through classification, metadata extraction, and content analysis. Next came AI assistants that could answer questions and help users find information.

We are now moving towards agents that can interact with enterprise information and perform business tasks.

While this creates tremendous opportunities, the greater the autonomy we give to AI, the more important governance becomes.

Permissions must define what an agent can access and modify. Its actions must be auditable and traceable. Human validation must ensure that important decisions remain under the right kind of control.

As ECM consultants, our role is evolving too. We are no longer solely responsible for designing information models, workflows and document management solutions. We also need to help organizations define how AI agents should interact with their information, how much autonomy they should be given, and in which areas human responsibility must remain.

The future of ECM is not about giving AI unlimited access to enterprise information. It is about providing AI with the appropriate context, permissions and level of autonomy.

An AI agent that can act without governance is not automation. It is an uncontrolled risk.