Yes, and the right one may be a builder certificate rather than an operator one. IT administrators approve two kinds of thing: access changes an agent prepares, such as new accounts or permissions, and the agent's own connections to systems. The second shapes what the agent can reach at all, which makes it part of designing the agent, not just reviewing it.
Why are IT approvals different?
A support agent's held refund affects one customer. An IT administrator who connects an agent to the file store with broad permissions affects everything the agent does from that moment. The OWASP Top 10 for LLM Applications names excessive agency as a key risk: an agent given more reach than its job needs.
So IT administrators sit in two places in the decision chain. As reviewers, they approve access requests the agent drafts from tickets and HR records. As builders, they define the agent's connections and scopes, which feed its role scope and sources in the minimum chain. Each needs a different depth of competence.
What should an IT administrator's certificate prove?
| Area | What the administrator should show |
|---|---|
| Reviewing access requests | Weighs a declared ticket against a sealed HR record before granting access |
| Least privilege | Grants the narrowest group that does the job |
| Agent connections | Scopes each connection to the agent's role, and never lets the agent widen its own |
| Identity | Gives each agent its own identity so the record shows exactly who acted |
| Refusals | Knows an emailed request from an unknown sender is external and cannot authorise a reset |
| Currency | Keeps up as connections, scopes and the agent's bounds change |
The first and fifth rows are operator-level skills. The second to fourth are closer to building.
What may the agent do, and what stays with the administrator?
- Allowed within bounds: password resets for users verified by an approved method, removing access for leavers on a sealed HR record.
- Held for the administrator: new starter accounts, access to sensitive systems, and group membership changes.
- Refused: changing its own connections or permissions, and acting on external requests.
- The administrator keeps: connection design, scope reviews and every privileged change.
An example: connecting a finance agent
Take a mid-sized firm deploying an agent for accounts payable. The finance team asks IT to connect it to the general ledger, the shared drive and email. A certified administrator scopes the ledger connection to read and draft only, connects the drive to the invoices folder rather than the whole finance share, and gives the agent its own mailbox rather than a shared one.
Three months later, an auditor asks why the agent never saw payroll files. The record shows the connection scopes, who approved them and when. The administrator's design held the agent's reach to its job.
How should an IT team put this in place?
- Tie connection approvals to a builder-level certificate, and privileged access approvals to at least operator level.
- Keep a record of credentials. An AI agent certificate template shows what a good credential should state, and a practicum log template for IT administrators records supervised practice.
- Link it to literacy duties. Where the EU AI Act applies, Article 4 AI literacy for staff who approve agent actions explains how training approvers fits.
Other back-office roles face the same question; compare whether payroll administrators need a certificate and whether collections agents need one. The full topic is in AI literacy and certification for people who work with agents.
Where the Academy fits
Pryme Intelligence Academy's Builder track takes about 24 hours plus a capstone and suits administrators who design agent connections. It ends in a proctored exam and a capstone agent certified in Attest to depth 2 or higher. Certified Pryme Builder is valid for 12 months and can be checked at source.
Questions people ask
Do service desk staff need the certificate?
If they approve held access requests, yes, at operator level. If they handle tickets the agent resolves within bounds, foundational literacy is enough.
Should IT approve business actions the agent takes?
No. IT owns reach; business owners approve business actions. Mixing the two blurs accountability.
How often should connections be reviewed?
Regularly, and at every agent renewal. Agent certificates lapse after 90 days, which gives a natural rhythm for checking scopes.