Why your management system should be built for AI agents

An assistant without access to your documents will still answer, using what is typical for organizations like yours. Typical is often close. Close isn't good enough when the question is how fast to report an incident. Under cybersäkerhetslagen, an essential or important entity owes NCSC an early warning within 24 hours of becoming aware of a significant incident, and the person asking needs to know who in your organization makes that call.

ISO 27001 already points this way. Clause 7.5 is about controlling documented information, and part of controlling it is making sure the people who need it can reach it at the moment they need it. If the first place people look is now a chat window, a policy that only exists as a PDF on the intranet fails that test in practice, however well it is written.

Any modern assistant can summarize a PDF. The interesting part starts when you want the agent to do something, like adding a new supplier to the supplier register or filling in this quarter's access review. That's where agents go wrong, and they go wrong in a predictable way: given an empty field and no rules, they write something plausible.

So the shape of the management system matters more than the model. In Aquil, the things an agent works on carry their rules with them. A register has columns with types, required flags and fixed lists of options. A report template knows which fields must be filled in and which values are allowed. A process is a set of steps and yes/no decisions, and each step links to the register, report or document it needs. Aquil tells every agent to look that structure up before it writes, and refuses a register entry that misses a required field.

A Word document can't tell an agent any of that. A register can.

The first thing an auditor asks about an agent is what they ask about a person: show me the control operates, and show me who is responsible for it. Clause 5.3 has top management assign responsibilities and authorities to roles. An AI assistant isn't a role on your organization chart, and it should never end up holding one by accident.

That's why an agent in Aquil always works as a named person. Everything it changes goes into the activity log under that person, with the connection it used noted alongside. It can fill in a report, but it can't sign it off: approval fields are stripped from what an agent writes into a report, and approving stays something a person does in the app. When it adds to a register its user doesn't own, the entry waits for the owner's approval the same way anyone else's would. The permission model behind this is described in Let AI agents into your ISMS without handing over the keys.

My own rule is simple. If no person would answer for what an agent did, the agent shouldn't have been able to do it. That rules out the shared service account with an API key, which is still how most of these integrations get built.

Sokigo is ISO 27001 certified, and we run our own management system in Aquil. The AI coding agent we use when developing Aquil reads our security policies from Aquil over MCP and turns them into the rules it works by: logs kept for at least six months, no personal data in logs, no shared accounts, AES-256 for sensitive data at rest. When a change adds new attack surface, its security risk analysis is filled in as a report in Aquil and lands with me for approval before it ships. The agent does the typing. I sign.

It has also shown us the limits. Once, a re-sync came back with one policy instead of nine, because the account the agent works through could no longer see the rest. It said so, kept the previous rules and marked them as unverified. That's the behaviour you want, an agent that tells you what it couldn't read instead of filling the gap. It also showed that the agent's view of your policies follows the access of the person behind it, which cuts both ways.

Don't start with write access. Start by letting people ask questions that get answered from the policies you've approved, and add the rest one step at a time:

• Connect one assistant with read access to policies only. Questions about acceptable use, passwords or incident reporting then get answered from your own documents.
• Pick the recurring report everyone puts off, such as the quarterly access review, and let an agent draft it from sources you point it to. A person still approves it.
• Open up registers next: incidents, assets, suppliers. Entries from someone who doesn't own the register go to the owner first.
• Leave processes for last. An agent that walks a new employee's onboarding and comments on each step leaves an evidence trail, but only once your processes are worth following.

MCP, the Model Context Protocol, is how agents reach Aquil. Since December 2025 it has been governed by the Agentic AI Foundation under the Linux Foundation, and support has spread to ChatGPT, Microsoft Copilot, Gemini, Cursor and VS Code, so building for it doesn't tie you to one AI vendor. Aquil connects to Claude, ChatGPT, Cursor and VS Code through a custom connector and your normal Aquil sign-in.

On the Free plan the MCP service is switched on from the start. On Professional and Enterprise it's an add-on we turn on for you. You'll find the server address under Settings → API & MCP. If you don't have an account yet, create a free one and connect an assistant to your policies before you give it anything to write.