Your agent stopped asking for permission. Did your oversight plan notice?
Auto-approve and write access can change how humans oversee your AI. heyGRC flags it in the pull request that ships it.
The situation
You add an "auto" mode so the agent can write to the customer's tools without a click each time. The code is careful: opt-in, fail-closed, audited. The compliance file still describes a human approving every write.
The real finding
heygrcMediumAI system impact assessment not updated for new auto-approval operating mode
The auto-approval path removes per-instance human review of AI-proposed writes to external systems. This materially changes the oversight model for the AI system and should be documented in the impact assessment before or upon enablement.
Fix Cover the auto mode, its opt-in, its fail-closed behaviour and residual risks. Check whether a DPIA review is triggered if those writes touch personal data.
See the demo review → A demo pull request that reproduces the pattern.
It found the one thing outside the code
The same review called the access-control design sound. heyGRC was not hunting for problems in good code. It found the one gap the code could not close: the document that describes how humans oversee the system.
What heyGRC checks
AI system impact assessment
ISO 42001 A.5.2ISO 42001 A.5.3Human oversight, if your system is high-risk
EU AI Act Art. 14EU AI Act Art. 26(2)When a DPIA is required
GDPR Art. 35(1)