Do not let autonomous workers touch revenue systems through borrowed human access. Give every tool a custodian, every permission a lease, and every action a rollback path.
Tool custody is the operating layer that decides which machine worker can use which system, for what action, under whose accountability.
In revenue operations, tool access is not neutral. It can change pipeline truth, contact customers, spend credits, expose data, or create cleanup debt.
Teams can expand agent capacity without turning every integration into a silent side door through the business.
The first generation of agentic operations treats tools like fuel: connect the CRM, connect enrichment, connect email, connect billing, then let the worker move faster.
That is backwards. A machine worker with the wrong tool can create more organizational risk in ten minutes than a human can create in a week, because the system will repeat the mistake at machine speed.
The right question is not can the agent use this tool? The right question is who owns the consequences when it does?
Stage moves, owner changes, field edits, lifecycle updates, task creation, and source-of-truth mutations must be scoped to explicit workflows.
Outbound tools need channel limits, suppression checks, sender identity rules, rate ceilings, and human-visible preview for sensitive accounts.
Data vendors can leak budget through vague research loops. Workers need spend caps, query purpose, freshness tests, and dedupe rules.
Invoice, discount, renewal, refund, usage, and contract systems should be read-mostly unless a named owner approves the exact write path.
Customer pain is useful context, but it is not permission to message, promise fixes, expose private tickets, or route around account owners.
If an agent acts through a human login, the organization loses the ability to distinguish human judgment from machine execution. That breaks review, coaching, incident response, and trust.
Borrowed access also hides scope creep. A worker starts by updating lead research, then discovers it can edit lifecycle stage, enroll contacts, add discounts, or trigger customer emails because the integration was never narrowed.
Machine-worker management has to make access legible. Every action should answer four questions: which worker, which tool, which permission, which owner?
Name the person or team accountable for the integration, permission model, review cadence, and emergency revocation.
Separate read, draft, recommend, queue, write, send, spend, delete, and override. Most workers need fewer verbs than teams assume.
Give permissions an expiry date, renewal condition, workload reason, and automatic downgrade when the workflow is idle.
Capture request, source data, tool action, affected record, before-and-after state, and the policy that allowed the move.
Define how to revert bad field edits, stop sequences, refund accidental spend, revoke credentials, and notify affected owners.
The point is not to slow every worker down. It is to stop pretending that tool access is an implementation detail.
A good custody layer lets agents research freely, draft safely, and execute narrow actions with confidence. It also blocks the classic failure mode: a smart worker using a powerful tool for a reason nobody approved.
Heads of Growth should treat every new agent integration like hiring a contractor with a company credit card, CRM admin rights, and customer-facing email. Useful, yes. Casual, no.
Reviews show a person changed the record, but the real actor was an automation, worker, script, or model-driven workflow.
A temporary experiment keeps write access months after the campaign, customer segment, or operating reason disappeared.
When a worker changes the wrong records, the team knows who is annoyed but not who can undo the system damage quickly.
List every agent, automation, integration, and shared key with access to CRM, sequencing, enrichment, billing, support, and analytics tools.
Tag each integration by what it can actually do: read, enrich, draft, write, send, spend, delete, assign, or override.
Put expiry dates and renewal reasons on non-read access, especially anything touching customer communication or revenue truth.
Pick one worker, simulate a bad action, and prove the team can identify, stop, revert, and explain it within one operating window.
Before connecting one more autonomous worker to a revenue tool, create a custody packet for the highest-risk integration already live.
If the team cannot explain who owns the access and how to undo a bad action, the worker should not have that access yet.