AI agent monitoring is the routine work of checking that an agent your company runs is still doing its job: its answers and actions are correct, it reads only the data it was allowed to read, it costs what was budgeted, and a named person hears about it when it fails. For a small or mid-sized business that comes down to four measures reviewed on a schedule (quality, access, cost and failures), a log of every action the agent takes, and an owner with the authority to pause it. This guide is the operating checklist for the months after launch; the identity and credential design that comes before launch is in our guide to AI agent identity and access control.
It applies to a Copilot Studio agent, a ChatGPT workspace agent or plugin, a Claude-based agent or an automation with AI steps; the screens differ, the questions do not.
What should you monitor once an AI agent is live?
Four things, each with its own measure, cadence and reader: the process owner reads quality, IT or your provider reads access, cost and failures, and putting all four on one page each month is most of the discipline. NIST's AI Risk Management Framework names four functions, Govern, Map, Measure and Manage; the last two are this page.
| Area | What to measure | How often | Who reads it |
|---|---|---|---|
| Quality | Score on a fixed evaluation set; accept, edit and reject rates in the approval queue; how often the agent hands off to a person | Weekly for the first month, then monthly | The manager who owns the process |
| Access | The permissions, tokens and connections the agent holds, compared with the list written at launch | Monthly, and whenever a vendor changes an app or connection | IT or the provider, with the security owner |
| Cost | Usage per run, seat licenses, platform fees, and the trend against budget | A weekly glance at the budget alert, a monthly review | IT or the provider, with whoever pays the bill |
| Failures | Errors, timeouts, stalled runs, stale data, and every action a person rejected | Automated alerts the day they happen, summarized monthly | The on-call owner, then the monthly review |
How do you measure an AI agent's quality without reading every output?
- Keep an evaluation set. Thirty to fifty real cases with the outcome you expect. Rerun them after any change to the model, the prompt, the knowledge or a connection, and record the score next to last month's; vendors update models on their own schedule, so an unexplained drop is a model change until proven otherwise.
- Use the approval queue as a live signal. Count accepts, edits and rejects per action type, with the threshold decided in advance; a common rule is to pause an action type when more than one proposal in five is being edited.
- Sample transcripts. A fixed number each week, read by the process owner rather than IT, looking for confident wrong answers and answers drawn from the wrong source.
- Add cases as the business changes. A new product line, a redesigned form or a renamed field changes what the agent sees, and the evaluation set catches it only if it grows.
- Do not let the model grade itself as the only check. A model-based review is a filter; the evaluation set and the human sample are the measure.
How do you keep an agent's access from growing?
The launch document lists what the agent may read and write. Access monitoring is comparing reality with that list every month and after every vendor change.
- Review the grants where they live. For Microsoft 365, Microsoft's guide to reviewing permissions granted to enterprise applications shows the path (Entra ID, Enterprise apps, the application, Permissions, Admin consent) and how to revoke a permission. Do the same for CRM connections, API keys and MCP server credentials.
- Re-review when a vendor adds capabilities. Read-only connections gain write actions: Microsoft's Copilot connectors documentation announces write actions for federated connectors from early October 2026, and OpenAI's app controls let admins decide how new actions are treated. Set that control to "only new read actions" or "disable new actions" so capability arrives by decision, not by update.
- Rotate and retire credentials. Rotate on your policy's schedule and remove anything tied to someone who has left, including the person who built the agent.
- Keep the approval rules per action type. Money, client records, outbound messages and system settings wait for a person. OWASP's entry on excessive agency gives the fixes: limit the extensions an agent may call to the minimum necessary, require a human to approve high-impact actions, and implement authorization in downstream systems rather than relying on the model to decide.
How do you monitor AI agent costs?
Three cost lines, and only one moves on its own: seats are fixed per month, platform fees (hosting, automation runs) move slowly, and usage moves with every run, tokens in and out multiplied by runs, with a retry loop multiplying it again (OWASP lists this as unbounded consumption). The controls, as of October 2026:
- Caps at the provider. In ChatGPT Business, OpenAI's spend controls let owners and admins set monthly credit limits per seat type and per user, usage alerts and automatic reload; by default, OpenAI notes, no limits are specified. In Enterprise and Edu, an overage limit of zero blocks new credit-using requests once the committed pool is exhausted. Set them before launch.
- Rate limits and a kill switch in the agent. A maximum number of runs per hour and tool calls per run, plus a documented way to stop the agent that does not depend on the person who built it.
- Cost per accepted outcome. Divide the month's usage by the runs a person accepted, not by runs started; an agent that is cheap per run and rejected half the time is expensive.
- An illustrative calculation, written for this page rather than taken from a client: 400 requests a month at roughly 20,000 tokens each is about 8 million tokens; multiply by the published per-million rates for the model in use, add seats and hosting, and compare with the hours returned.
What does an agent failure look like, and who gets told?
| Failure | How you notice | What the owner does |
|---|---|---|
| Hard failure: API down, token expired, schema changed | Error alerts from the platform; runs stop | Pause, fix the credential or schema, rerun the evaluation set before resuming |
| Silent failure: stale source, wrong record matched, an empty result treated as "nothing to do" | Only through the sample and the evaluation set | Add a check for empty or stale data; make the agent say when it found nothing |
| Behavior failure: instructions hidden in an email or document steer the agent | Rejected proposals in the approval queue; unexpected tool calls in the log | Treat it as an incident: stop the agent, read the log, add the case to the evaluation set |
| Cost failure: a loop or retry storm | The budget alert | Kill switch first, then find the loop |
Every alert goes to a named person with a backup, each failure type has a short runbook, and an agent that cannot reach its systems should stop loudly rather than guess. Enterprise and Edu workspaces can also send ChatGPT conversation and agent events to compliance tools through OpenAI's Compliance Platform, which keeps immutable logs for 30 days and integrates with tools such as Microsoft Purview.
What changes when the agent runs inside ChatGPT?
The names changed in 2026 and the controls live in the workspace. "Agent mode" and Operator are gone; OpenAI's current agent products are ChatGPT Work (longer multi-step tasks that produce finished documents), Dots (always-on agents, which on ChatGPT Business require a Premium seat) and workspace agents on Business and Enterprise, which combine a model, tools, apps, custom MCP servers, skills and files and run on a schedule or from an API trigger. Four items belong on the monthly page:
- Approval settings. OpenAI offers "Always ask", "Allow read actions", "Allow low-risk actions" and, per app only, "Allow all actions", which it warns carries more risk; workspace agents default write actions to "Always ask". Record the setting for every app the agent uses and treat a loosening as a release.
- Agent-owned versus end-user authentication. A workspace agent authenticates either as the agent or as the person using it. Review agent-owned connections like a service account: who holds the credentials, which systems they reach, and who may publish an agent with agent-owned connections (a separate role setting). With end-user authentication each person's permissions apply.
- Usage and credits. ChatGPT Work usage is billed per token through credits, so a scheduled agent adds a usage line; the spend controls above cap it, and usage alerts are the early warning.
- Logs. Business admins get usage analytics; OpenAI's help center says members' private chats are not automatically visible to them, while its enterprise privacy page says workspace admins can view, export and delete conversations. Enterprise and Edu get the Compliance Platform, the route for agent and conversation events into your security tooling.
What goes into a monthly AI agent maintenance review?
- Rerun the evaluation set and record the score next to last month's.
- Read the approval queue statistics by action type and compare with the thresholds.
- Read the week's transcript sample with the process owner.
- Compare current permissions, tokens and connections with the launch list; revoke extras; rotate anything past its date.
- Read the vendor release notes for the model and every app or connection, noting capability and retirement changes such as OpenAI's custom GPT retirement on December 11, 2026.
- Reconcile cost against budget: seats, usage and hosting, and cost per accepted outcome.
- Review every failure and incident; update the runbooks.
- Test the kill switch and confirm the on-call contact is current.
- Collect change requests from users and schedule changes as a release with an evaluation run.
- Update the agent's one-page charter and file the review.
Who should own an AI agent after launch?
| Responsibility | Business process owner | IT or managed provider | Vendor |
|---|---|---|---|
| Deciding what a good result is; reading the sample; approving actions | Yes | Advises | No |
| Permissions, credentials, logs, alerts, cost caps, releases | Signs off | Yes | No |
| Model behavior, platform uptime, app and connection capabilities | No | Tracks and reacts | Yes |
| Pausing the agent | Can request | Can execute | No |
In a small company the middle column is usually a provider. Ask one for a monthly report in the shape above, a named owner and backup, kill-switch access for your own staff, and permissions documented so your security owner can revoke them without a ticket. That is what AI agent support means in practice.
How NetSys monitors and maintains agents
Agents NetSys builds, in Copilot Studio or on Anthropic Claude, start in shadow mode with every action logged per task, rate limits and spend caps set, a kill switch in place and permissions documented so your security owner can revoke them without calling us. After launch they run under our managed AI services agreement, month to month: we watch for errors, cost drift and model changes, rerun the evaluation set after changes, review permissions monthly and sit in the monthly review with the process owner. The same routine covers our AI workflow automation work, agents from our AI agent development service, and ChatGPT plugins or workspace agents built around governed integrations.
Discuss ongoing AI management with an engineer, starting from the agents you already run.
Frequently asked questions
What is AI agent monitoring?
The scheduled checking of an agent's quality, access, cost and failures against what was agreed at launch, with a log of every action and a named owner who can pause it. It is operations work, not a one-time security review.
What are AI agent monitoring best practices?
A fixed evaluation set rerun after every change; approval-queue statistics per action type with thresholds decided in advance; a monthly comparison of actual permissions with the launch list; spend caps at the provider and rate limits in the agent; alerts to a named person; and a monthly review filed with the agent's charter.
How much does it cost to maintain an AI agent?
Three lines: seat licenses, usage billed per token or credit, and the people time for the monthly review and changes. NetSys runs the people time under a month-to-month managed agreement quoted after a scoping call; we publish no price list. The usage line is the one to cap on day one.
What is AI agent support?
The service of owning the middle column above: credentials, permissions, logs, alerts, cost caps, releases and incident response for agents a company runs, with a report the business owner can read.
Discuss managed ai services for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.