How to keep IT administrators ready for an AI agent’s 90-day recertification

IT administrators have two jobs in every cycle: keep the agent's connections no wider than its new certificate, and keep the service desk briefed on what the IT agent now does. Every 90 days the certificate lapses unless renewed. Each renewal can change scope, sources and depth, and the administrator is the person who makes the plumbing match.

What does recertification change for IT administrators?

IT administrators meet agents from two sides. First, they run an IT service agent: it triages tickets at depth 1, drafts change requests at depth 2, resets passwords and grants standard access from an approved catalogue at depth 3, and holds privileged access requests for a named administrator. Second, they own the connections every other agent uses: service accounts, credentials, API scopes and the systems of record behind sealed sources.

Recertification re-runs the agent on the organisation's own cases. For the IT agent, a typical change is a narrower set of access it may grant, or a new refusal on requests that arrive from outside the organisation. For other agents, a change in sources or scope means the administrator may need to add or remove a connection.

The risk is a mismatch. If an agent's certificate drops it to depth 1 but its service account can still write to the system, the minimum chain still stops it, because the certificate is one of five bounds checked at the moment of action and the lowest wins. But a credential wider than any certified use is exactly the excessive agency the OWASP Top 10 for LLM Applications warns about. Least privilege should hold in the plumbing too. A general account of the cycle is in what recertification is.

Who owns what?

The IT operations manager owns administrator readiness and the service desk rota. Each agent's builder owns its recertification. Administrators own connections and credentials. Information security owns the policy on privileged access.

Steps for each cycle

1. Agent, depth 1: list agents due for recertification in the next 30 days, with current sources and connections.
2. Person (builder): recertify and publish the new scope and sources per agent.
3. Agent, depth 2: draft a connection change list comparing each agent's certified sources with its live connections.
4. Person (administrator): review and apply changes, narrowing any credential wider than the certified use.
5. Person (IT operations manager and builder): write the change note for the service desk: access the IT agent may now grant, new refusals, held requests.
6. Agent, depth 2: draft practice tickets, including one with an embedded instruction in an external email, checked by information security.
7. Person (IT operations manager): brief the desk.
8. Person (senior administrator): review held privileged requests in the first fortnight.

What should administrators retrain on?

Prompt injection. Tickets and emails are external content. An instruction hidden in a forwarded email should never cause the agent to act, and administrators should recognise the pattern when reviewing a refusal.

Reading the deciding bound. When a request is refused, the verdict names the bound that decided. "Certificate" means the agent is not certified to the depth the action needs; "own limits" means an organisational rule. The fix differs, and administrators should not widen a credential to get round either.

Held privileged requests. Read who asked, through which channel and for what. A request from a known user through the service portal is not the same as one forwarded from an unknown address.

Connection hygiene. After each cycle, every credential should map to a capability in the agent's role scope. Unused credentials are removed.

Controls and the evidence they leave

• Connection review after each cycle. Evidence: the comparison list and the changes applied.
• Change note for the desk. Evidence: dated note and attendance.
• Named approval on privileged access. Evidence: approvals in the append-only record.
• Injection practice ticket each cycle. Evidence: the ticket and how each person handled it.
• Practicum for new administrators. Evidence: the practicum log template for IT administrators.

What to measure

Credentials wider than certified use, found per cycle (aim for none). Time held privileged requests wait. Reopened access tickets. And refusals that the desk overrode by hand, which should be rare and always documented. A rise in manual overrides after a cycle means the change note did not explain the new refusals.

Where does readiness slip?

Connections lag certificates. An agent loses a source at recertification, but its credential stays because nobody owns the clean-up.

The desk learns about new refusals from angry users. A short note before the effective date avoids this.

Administrators treat agent service accounts as infrastructure rather than as identities with authority. They are identities, and the same review applies. Payroll and support teams depend on the same connections; compare keeping payroll administrators ready and keeping customer support agents ready.

Where the Academy fits

Pryme Intelligence Academy's Operator track covers reading the workspace and when something goes wrong, which suits administrators on the service desk. Administrators who design connections and certify agents are closer to the Builder track, which ends with a capstone agent certified in Attest to depth 2 or higher. Every lab runs in a free Build workspace. More in the guide to AI literacy and certification for people who work with agents.