What an AI agent is in Business Central
An agent is a user. Microsoft says the Sales Order Agent "has a user account in Business Central, similar to other users, which defines the permissions the agent has on objects and data." The Payables Agent works the same way.
By default the Sales Order Agent gets the SOA - EDIT permission set, which covers what it needs to handle quote requests. The Payables Agent gets its own system permission set as well.
The Sales Order Agent does not borrow rights from the person supervising it. It "runs under its own user account and doesn't inherit permissions from the person reviewing the task."
The mailbox is a separate matter. The user who activates the agent needs Read and manage (Full Access) on the shared mailbox the agent works from, and Send as for the Sales Order Agent.
Who can switch on and configure an agent
Two system permissions decide who does what with an agent:
- Configure All Agents (ID 9665) lets a user create agent instances and change the configuration of any agent.
- Manage Agent Tasks (ID 9670) lets a user work with agent tasks in the Copilot pane. The user must also be on that agent's user access list.
Each agent also has its own access list. A user on it with Can Configure selected may configure that one agent, without holding Configure All Agents.
Microsoft states that "All current Business Central license entitlements include the Configure All Agents permission." Whether someone can configure agents comes down to their permission sets.
Configure All Agents comes with the AGENT - ADMIN permission set, and also with SECURITY and SUPER. So every user who still holds SUPER can configure agents too.
Where standard Business Central falls short
What standard Business Central gives you
- A user account per agent, with permission sets you can adjust through a modified copy
- An access list per agent that sets who works with it and who configures it
- The Copilot & agent capabilities page, where you deactivate capabilities and grant or deny access per user
- Review steps, a data review bar on changed documents and the Agent Task Log
- New vendors from the Payables Agent start with Blocked set to All
Where it stops
Copilot capabilities "are active by default when they're available in preview or generally available." A new feature can reach your users without anyone switching it on.
Microsoft also notes that Business Central "doesn't yet offer granular, object-level permissions so that only specific administrators can configure Copilot."
The Payables Agent has no approval step of its own. Microsoft: "The agent itself doesn't provide any capabilities for vendor approvals." It currently doesn't support approval flows either.
Standard Business Central also does not check permissions against segregation of duties rules.
How to control AI agents in Business Central
1. Decide who may configure agents
Give AGENT - ADMIN to the few people who should manage agents. Microsoft's advice: "To follow the principle of least privilege, use AGENT - ADMIN unless the user needs broader administrative access."
Then check who holds SECURITY or SUPER, because they can configure agents as well. Our article on the SUPER permission set explains how to cut it back to the few accounts that need it.
2. Narrow the agent's own permission sets
The default set is a system set, so you can't edit it. Set the agent's State to Disabled first; Microsoft requires that before you add or remove permission sets.
Copy the default set, take out what the agent doesn't need and assign the copy. For the Sales Order Agent, also check the Profile field: it sets the agent's home page and the UI elements it can use.
3. Handle extension errors with the narrowest set
Extensions can add logic to the pages an agent uses. A task then stops with "The agent needs additional permissions to continue".
Look up the extension and object from the error on the Permissions Overview page, and assign the narrowest permission set that grants the access.
4. Choose which Copilot capabilities are active
Copilot itself is a system feature. Microsoft puts it plainly: "Like most system features, you can't turn Copilot on or off." You control it per capability and per user:
| Capability | Access controlled by |
|---|---|
| Chat | Copilot Sys Features, or object 9690 |
| Analysis assist | Copilot Sys Features, or object 9710 |
| Autofill | Copilot Sys Features, or object 9700 |
| Summarize | Copilot Sys Features, or object 9680 |
| No. series suggestions | No permission set; anyone who can set up number series |
For environments hosted in the United States, Microsoft lists "No action required" on data movement. Elsewhere, the Allow data movement toggle decides whether prompts may be processed in another geography.
5. Assign supervisors and check their own access
Agents pause and ask a person to confirm emails, vendor or contact details and draft documents. Whether segregation of duties holds depends on what that person may do elsewhere in Business Central.
Questions to ask:
- Who is on the agent's user access list, and can the same people unblock vendors?
- Can someone who confirms a drafted purchase invoice also post the payment?
- Who can configure agents through SECURITY or SUPER without anyone having decided so?
Our guide to segregation of duties in Business Central shows how to build a conflict matrix for these combinations.
6. Trace what agents did
On the Agents page, select the agent, choose View tasks, then View log entries for the Agent Task Log.
Seeing the snapshot under "What the agent saw" needs the Agent - Diagnostics permission set. Assign it to the administrators who need to see that snapshot.
How 2-Controlware keeps agents in view
Authorization Box
Since the December 2025 update, Authorization Box shows AI agents explicitly in its monitoring. They are separated by license type, so you can tell human users and agents apart. Copilot capabilities themselves are set in Business Central, on the Copilot & agent capabilities page (step 4).
The same update brought security groups into the analysis. For each user you see which permissions are assigned directly, which come through a security group and which come from regular permission sets.
Authorization Box analyzes critical permissions per user, role and permission set. That includes the people who supervise agents.
Authorization Box manages permissions through organization roles, with an optional approval step on each request.
Advanced Permissions Management
Advanced Permissions Management logs every change to permission sets, including changes from app updates. You review those changes period by period. That includes user-defined permission sets, the kind you create when you copy an agent's default set.
