Ask an auditor to describe the control over a held action and they will not point at the agent. The agent is the activity being controlled; for anything it holds, the control is the reviewer who decides. Treat reviewers as a designed, tested and evidenced control, like any other, and many agent deployment failures stop happening.
Where does the control actually sit?
A governed agent operates inside several layers of control. Every action meets five bounds at once: role scope, certificate, sources, the business's own limits and the platform guardrails. The lowest one wins. Actions within all five are allowed. Actions outside the agent's bounds are refused. Some actions are withheld at the platform floor for every agent. And some are held: drafted and waiting for a named person.
For held actions, the bounds have done their work. They decided that this action should not happen without a person. What happens next depends entirely on that person. If they approve without reading, the action proceeds as if no control existed. If they read, check and decide, the control operates.
That is why the reviewer, not the agent, is the control for held items. The agent's job was to prepare and stop. The reviewer's job is to judge.
What does it mean to treat a reviewer as a control?
Every control in a well-run organisation has a few things in common. It has a control owner who answers for it. It is designed: someone has written down what it does and what it is meant to catch. It is tested: someone checks whether it operates. And it leaves evidence.
Applied to reviewers:
| Control property | For a reviewer, this means |
|---|---|
| Owner | A named manager answers for whether review in the team works |
| Design | Written criteria for what reviewers check on each type of held item |
| Competence | Reviewers are certified on observed work before they hold approval rights |
| Operation | The rota ensures held items reach a certified reviewer promptly |
| Testing | Approvals are sampled and checked for real review |
| Evidence | Each approval is filed with the reviewer's name, time and reason |
Most deployments have the last row, because the record captures it automatically. Few have the others in place.
What does this look like in a credit control team?
Take a credit control team where an agent drafts dunning letters, allocates exact-match receipts and proposes account stops. Stops and write-offs are held.
The control over a wrongful account stop is the credit controller who reviews the held stop. For that control to work, the controller needs to know what to check: agreed terms, any disputes, whether the customer is on a protected list, whether sales has been consulted. They need certification showing they check those things. The rota must ensure a certified controller is always available; how to build a reviewer rota for a credit control team covers that. New controllers need structured onboarding before they hold rights, using something like a reviewer onboarding checklist for a credit control team.
None of that is unusual. It is what a finance team would do for any control over cash. The difference is recognising that the reviewer is that control.
Why do organisations point at the agent instead?
Because the agent is new and visible, and the reviewer is familiar. Risk assessments for agent deployments often focus entirely on what the agent might do wrong: hallucinate, exceed its scope, act on a manipulated input. Those risks are real, and the bounds, certification and provenance rules address them.
But the risk assessment then treats "human review" as a mitigation and moves on, as if the existence of a reviewer settled the matter. It does not. A reviewer is a control that can fail, and it fails in predictable ways: fatigue, rubber-stamping, lack of training, unclear authority. The definitions of an agent reviewer and an AI agent reviewer both centre on judgement, which is exactly what has to be designed and tested.
What is the trade-off?
Calling a person "a control" can feel mechanistic. Reviewers are people with judgement, not checkpoints, and some will dislike being described in audit language.
There is also a risk of over-reliance. If the organisation believes the reviewer catches everything, it may relax other controls on the agent. That would be a mistake: the bounds and certification should stay as tight as the evidence supports, with the reviewer as the last line, not the only one.
The first concern is mostly about language. Reviewers are trusted precisely because they exercise judgement; treating their role as a control just means taking that judgement seriously enough to support and test it. The second is a design principle: layered controls, each doing its job.
What should you do differently?
Name a control owner for review in each team. Write down what reviewers check for each type of held item. Certify reviewers before they hold approval rights. Build a rota so held items always reach someone certified. Sample approvals regularly. And when you write the risk assessment for an agent, describe the reviewer as a control with the same care you give to the agent's bounds. The guide to AI agent skills by role sets out what reviewers need to know.
Where the Academy fits
Pryme Intelligence Academy's Operator track is designed for reviewers as a control. It covers how a governed agent decides, human review, reading the workspace and when something goes wrong. Certification requires a written exam and a practicum of real review decisions with no missed red line, signed off by a Pryme assessor, which gives the control owner evidence of competence.
Questions people ask
If the reviewer is the control, does the agent need certifying at all?
Yes. The agent's certification decides what it may do alone and what it must hold. Without it, far more would reach reviewers, or far more would be allowed without them.
Who should own the reviewer control?
Usually the manager of the team doing the review. They answer for whether reviewers are certified, the rota works and approvals are sampled.
How often should the reviewer control be tested?
As often as other key controls in the same area, typically at least quarterly, with more frequent sampling when a new agent goes live or depth changes.