AI Agent Governance for Construction: Containment Is Not a Credit Memo

Most AI agent governance for construction is being designed by security teams, and it shows. Sandboxes. Least-privilege permissions. Spend caps. Audit logs. All of it is sensible, and all of it is a statement about the agent's environment. Now follow a pay application out of the building.

The moment you submit one, it stops being yours. It becomes a draw request at a lender, an amount owed on an owner's books, a condition in a lien record, a line in a schedule your surety reads. The money moves because a document you produced entered someone else's records and was believed.

Where the controls sit

Look at what vendors are putting in writing this autumn. Microsoft published "Policy-driven containment for AI agents" on its Windows Developer blog on October 7. Its Business Central FAQ says the Payables Agent doesn't post purchase invoices and that people review what it prepares. Adaptive says its agents "never post to the general ledger on their own." Those are real controls, and we are glad vendors are stating them.

Notice where they sit. Some act before the agent does anything: what it can reach, whose permissions it uses, what it can spend. Some act at the gate: a person looks first. Both are on your side of the line. Once a document crosses it, neither can reach it. Containment protects your environment. It does not protect the counterparty's record.

Three moments of control. Examples are from the vendor material named in the text.

A submitted pay application lands in systems you do not control. Illustrative.

Accounting never built perimeters

It built remedies. The credit memo, the reversing entry, the superseding change order, the WIP adjustment. Retainage exists because work may need fixing after it has been billed. Each of these starts from the assumption that an error will happen and describes what comes next. None of them was invented for software, and all of them apply to a document an agent prepared.

Review gets most of the attention in agent discussions, and it should. A review step is a control before the document leaves. But a tired reviewer will let one through eventually, and Microsoft's own FAQ keeps review confirmation separate from a Business Central approval workflow. Review and approval are two jobs. Neither one is a remedy.

A scenario, invented for illustration. An agent assembles a pay application. A reviewer with forty items to clear before lunch presses Done. The application goes to the owner with stored materials counted twice, and the lender funds the draw. Three weeks later someone notices. The sandbox, the permissions, and the review log do not help now. What helps is a remedy that already exists: a new billing version, a call to the owner, a correction in the next draw and a note in the WIP schedule so the surety's numbers match. Who does each of those, and in what order? If the answer is "we would work it out", the work happens at the worst moment, in front of the people you least want to improvise for.

What AI agent governance for construction needs to add

One line per agent task, written before the task goes live: if this is wrong after it leaves, what is the remedy, who performs it, and what trail does it leave? We would put that line in the same document as the agent's scope and its named approver.

Four documents an agent might prepare, and the remedy that should be written beside each. Illustrative.

Two cautions. First, this is our view of what a good control list looks like, not a standard. Second, we are not saying any vendor lacks a remedy. We are saying that in the vendor material we read for this piece, the remedy was the line that got the least space. Ask for it by name.

It is also worth being plain about what software can promise here. Containment limits what an agent can reach. Reversal addresses what it already did. Those are different features, and a claim of one is not a claim of the other.

Where Netsmartz Construction Intelligence Platform fits

We think about this in three layers. The product layer is ProjectPro, built natively on Business Central. Its progress billing documentation describes creating a new billing version when a billing is rejected, which is a remedy designed for people and works the same for a document an agent prepared. The practice layer is our Business Central implementation team, which sets up roles, approval of workflows and permissions before an agent goes near production. The agent layer is the rule we would ask any vendor to meet: every agent task has a written scope, a named human approver and, beside them, the remedy.

Where to start

Pick one agent task you are considering this quarter. Write down what it prepares, where that document lands and what you would do if it were wrong. If the third answer takes longer than the first two, you have found your governance gap before an agent does.

Write the remedy next to the agent task

Bring one agent task to our team and we will map its scope, approver and remedy with you. Map Your First Agent Task

Frequently Asked Questions