14 Oct 2026 · Constance Ibe-Whitmore (editorial persona) · MSP and SMB channel · on threat.cafe

Your MSP's AI agents have admin on your tenant: seven questions clients will ask, and good answers

An MSP that lets AI agents work inside client environments should be able to answer seven questions with evidence, not assurances. Which agents run, and for which tasks. Where client data goes. Who approves an action before it touches production. How errors are handled and reported. What written policy governs it. How each agent's access is scoped per tenant. And what happens on exit. The pressure is concrete: Verizon's 2026 DBIR puts third-party involvement in 48% of breaches, and nine 2026 additions to CISA's exploited-vulnerability catalog hit the remote-support tools MSPs use to reach clients. In the UK, a pending bill would put managed service providers under statutory incident-reporting duties.

This article is general information, not legal advice. For obligations in your jurisdiction, consult qualified counsel and the regulator's own guidance.

What changed: the MSP is now an agent operator

The client questionnaire has been about the MSP's people and tools. It now has to cover the MSP's agents, which act with whatever credentials the MSP's people hold. An agent that can open a remote session, run a script through the RMM, or change a firewall rule inherits the MSP's multi-tenant reach. A mistake or a compromise is no longer bounded by one technician's shift.

Infonaligy's June 2026 client guide lists seven questions clients should put to their MSP. This article adopts that list and adds the other half: what a defensible answer looks like and what evidence should back it.

Legal status: what is binding, and where

Most of what follows is prudent practice, not statute. One jurisdiction is moving toward statute.

The UK government's Cyber Security and Resilience Bill would bring "relevant managed service providers" into the NIS framework. Mayer Brown's March 2026 summary describes the proposed definition as a managed service provided in the UK that "involves ongoing management of information technology systems for customers" through access to "network and information systems relied on by the customer". As summarised there, in-scope providers would have to:

register with the Information Commission;
take "appropriate and proportionate technical and organisational security measures";
send an initial incident notice within 24 hours of becoming aware, and a full notice within 72 hours, with copies to the CSIRT;
take reasonable steps to notify UK customers likely to be adversely affected.

Proposed maximum penalties run to the greater of £17 million or 4% of worldwide turnover for the more serious failures. At the time of that summary the bill remained subject to Parliamentary approval. Check its current status before treating any of these duties as in force. Mayer Brown notes that a size-cap rule applies to RMSPs; the threshold itself is not stated in the summary.

Jurisdictional scope: who should prepare now

Prepare now if any of these apply:

You provide ongoing managed IT services to UK customers.
Your contracts carry security schedules that require notice of material changes to service delivery. Introducing agents may be such a change; your counsel should decide.
Your clients are themselves regulated and pass security duties down to suppliers.

If none apply, the seven answers are still the fastest way to clear a client security review.

The seven questions, with an answer standard

1. What AI tools and agents do you use, and for what tasks?

Good answer. A named inventory: each agent or AI tool, its version, the tasks it performs, and the client tenants where it is enabled. Agent add-ons such as MCP servers, skills and hooks are listed with versions.

Evidence. An inventory export dated within the last 30 days.

Red flag. "We use AI to improve efficiency" with no list.

2. Where does client data go when it passes through AI systems?

Good answer. A data-flow statement per tool: which model provider, which region, retention period, and whether the contract excludes client data from training. Personal data processing is covered in the DPA.

Evidence. The provider's contractual terms and your DPA schedule, not a marketing page.

Red flag. Technicians using personal AI accounts. The Cyber Readiness Institute's summary of DBIR 2026 reports that 67% of users access AI services through non-corporate accounts on work devices.

3. What human oversight exists before agents act on production systems?

Good answer. A written list of agent actions that require a named human's approval: privileged changes, deletions, firewall and identity changes, anything touching backups. Read-only work may run unattended.

Evidence. Approval records for a sample week, showing who approved what.

Red flag. "A technician reviews everything", with no record of approvals. A prompt that is always clicked through is not oversight.

4. How do you handle AI actions or recommendations that turn out to be wrong?

Good answer. Agent errors enter the normal incident process. The answer states the client notification trigger and timeline. Where the UK bill applies once enacted, that timeline would need to support a 24-hour initial notice.

Evidence. The incident procedure, with agent-specific steps: stop the agent, revoke its credentials, preserve its logs.

Red flag. No way to stop all agents across all tenants at once. Ask to see the kill switch tested.

5. What is your AI acceptable use policy, and does it cover client data?

Good answer. A dated, owned policy that names permitted tools, banned uses, client-data rules and the approval path for new agent add-ons.

Evidence. The policy itself, its revision date, and staff acknowledgment records.

Red flag. A policy that covers chat assistants but not agents that execute actions.

6. How are AI tool access permissions scoped?

Good answer. Each agent uses a separate, per-tenant identity with the narrowest role the task needs. No agent holds a credential that works across tenants. Tokens are short-lived and audience-bound. The Model Context Protocol's security best practices state that "MCP servers MUST NOT accept any tokens that were not explicitly issued for the MCP server", and warn that broad scopes expand the blast radius of a stolen token.

Evidence. A role listing for each agent identity in one sample tenant.

Red flag. The agent uses the RMM's global admin account. The MSP's own tools are a live target: in the threat.cafe editors' count from CISA's KEV catalog data, 2026 additions through 15 October include nine entries for ConnectWise ScreenConnect, SimpleHelp, N-able N-central and BeyondTrust Remote Support, four of them marked as used in ransomware campaigns.

7. What happens to our data, and to the agents' access, if we leave?

Good answer. On exit, the MSP revokes every agent identity in the tenant, removes agent configuration and stored context, deletes client data held by AI providers where the contract allows, and confirms in writing.

Evidence. An offboarding checklist with an agent section.

Red flag. Agent memory or context files that persist on technician machines after the contract ends.

Must, should, may

Obligation                                         Must (if UK bill applies)   Should (prudent)   May
Register with the Information Commission           x
Proportionate security measures                    x
24h initial / 72h full incident notice             x
Notify likely-affected UK customers                x
Per-tenant, least-privilege agent identities                                   x
Human approval list for privileged agent actions                               x
Agent inventory export for clients                                             x
Tested cross-tenant kill switch                                                x
Client-visible agent action log                                                                   x
Contractual notice before enabling new agents                                                     x

The "must" column depends on enactment and on whether you meet the RMSP definition and size threshold. Everything else is an expectation clients and insurers can set by contract.

Questions for internal counsel

Do we meet the proposed RMSP definition, and does the size cap exempt us?
Does enabling agents in a tenant count as a material change under our client contracts?
Does our DPA cover each model provider as a sub-processor?
Can our incident procedure produce a 24-hour notice when the actor was an agent?

Open questions

The bill's final text, secondary legislation and regulator guidance will settle what "proportionate" means for agent operations. Until then, the evidence above is what a careful client will ask for, and what a regulator would likely look for first.

If you want one policy and log across agents in every client tenant, the threat.cafe early-access page describes the planned MSP tier.

Sources

#msp #ai-agents #client-due-diligence #uk-cyber-security-resilience-bill #least-privilege

All posts