Scoping each agent's connections to the minimum it needs is the IT administrator's most decisive skill, because excessive access turns a small error into a large one. Then, in order: keeping limit changes separate from review, responding to incidents, watching certificate expiry and drift, configuring source provenance correctly, and running access reviews for approvers.
What does an IT administrator own when agents arrive?
IT administrators connect agents to systems: the ticketing system, the general ledger, the HR system, the document store. They manage identities, credentials and access, and they are first responders when something breaks. They do not own what the agent decides. That belongs to the business owner of the agent, usually in operations.
The distinction matters because the admin's choices shape the bounds every decision runs inside. A connection that grants write access where read was enough widens the role scope for every action.
Which skills matter most, ranked by how often they decide an outcome?
- Scoping connections. Excessive agency is on the OWASP Top 10 for LLM applications. Give each agent the narrowest connection for its capability: read-only for a depth 1 reporting agent, write access only to the queue a depth 3 agent works. Review scopes whenever depth changes.
- Separating limit changes from review. The person who changes an agent's limits should not be the person who reviews its output, and neither should be the agent's builder acting alone. Admins enforce that separation in access groups.
- Responding to incidents. When an agent misbehaves, the admin needs to know what is platform and what is customer. A certification run that clears no depth drops the agent to depth 1 the same day automatically; the admin's job is to contain connections, preserve the record and bring in the owner, not to patch the agent's behaviour directly.
- Watching expiry and drift. Certificates lapse after 90 days. Admins set up alerts so owners see a renewal coming, and route drift warnings to the people who can act.
- Configuring provenance. Every fact reaching an agent is stamped sealed, signed, declared or external. If a feed from the system of record is wired in through an email inbox, it arrives as external and loses its authority. Getting the plumbing right preserves the stamp.
- Reviewing approver access. People who approve held actions should have access that matches their delegated authority, reviewed on the same cycle as other privileged access.
What does the agent platform enforce, and what does the admin configure?
| Area | Enforced by the platform | Configured by the IT administrator |
|---|---|---|
| Withheld actions | Refused for every agent at every depth | Nothing to configure |
| Depth | Set by certification evidence and the role's ceiling | Connection scopes that match it |
| Sources | Provenance stamp on every fact | Which feeds connect, and how |
| Approvals | Held actions wait for a named person | Who is in each approver group |
| Record | Append-only, every verdict filed | Retention and export to security monitoring |
What does connection scoping look like in practice?
Take a hospital group connecting a scheduling agent to the patient administration system. The agent's job is to offer and book outpatient appointments at depth 3. The default connector grants read and write access to the whole patient record.
The admin narrows it: read access to appointment slots and contact details, write access to bookings only, no access to clinical notes. When the agent later receives a patient message asking it to "update my allergy list", it has no route to do so even if its reasoning went wrong. The minimum chain refuses it at role scope, and the record shows exactly why.
Healthcare IT has particular data duties; see IT administrator training in healthcare in Spain. For how this role compares with others, see skills for payroll administrators and the team-level view in the skills matrix template for an AI agent team.
How should IT teams build these skills?
Run a tabletop incident: an agent with a lapsed certificate keeps trying to post to a ledger. Walk through who is called, what is contained and what the record shows. Then audit every agent connection against its current depth. Teams often find write access left over from a pilot. Admins who also oversee agents acting alone should read the skills that matter when agents act alone, and the full role map is in AI agent skills by role. A common grounding, such as the Foundations track at Pryme Intelligence Academy, helps IT and operations use the same words for depth and verdicts.
Questions people ask
Should IT own the agents?
No. IT owns connections, access and incident response. The agent's decisions and limits belong to a named business owner who answers for outcomes.
Can an admin raise an agent's depth?
Not in a governed system. Depth comes from certification evidence within the role's ceiling. An admin can only make sure connections do not exceed what the depth allows.
What should the security team monitor?
Refusals at role scope, repeated held actions on the same item, and any attempt by an agent to reach a system outside its connections. Export the record to security monitoring.