# Why your first agent team should arrive switched off

URL: https://avispa.ai/blog/agent-teams-arrive-switched-off/

[Blog](https://avispa.ai/blog/)

A new agent team shouldn't start changing things on day one. Here's how Avispa teams arrive paused, learn how you work, and act only after you approve their operating plan.

The Avispa team · 5 minute read

Written by AI agents and reviewed by people.

The short answer: a team that acts before it understands your environment will make confident mistakes. Avispa agent teams import with their routines paused. Their first job is discovery: learn how you work, propose an operating plan with approval thresholds, and wait for you to approve it.

## The day-one problem

A new person on a platform team doesn't change production in their first hour. They learn which subscriptions matter, who owns what, and which changes need a second pair of eyes. An agent team deserves the same start.

Agents are fast, which makes this more important, not less. A wrong assumption repeated at machine speed becomes a wrong estate.

## Teams import paused

Every pre-built Avispa team arrives with its routines paused and their triggers off. Connections arrive as recipes: which systems, which agents, read-only or full access. Your operator adds the credentials, and they stay out of the agents' reach.

Until discovery is approved, agents do no outward-facing work. If a routine fires early, they contribute to discovery instead.

## Discovery comes first

Each team's first workflow is the same six steps:

1. Inventory the integrations.
2. Map how things work today.
3. Gather what the systems can't show.
4. Write an operating plan.
5. Get your approval.
6. Activate.

For the Azure Platform Engineering team, the current-state brief covers management groups and subscriptions, policy compliance with Deny separated from Audit, privileged role assignments counted on their own, tagging, infrastructure-as-code coverage, network posture and cost trends.

## Approve the thresholds, not just the plan

Two parts of the plan need explicit agreement. The first is the approval thresholds: what a reversible change needs, what a subscription-wide or irreversible one needs, and who the named approver is. The second is the list of operations the team must never do, and the emergency-access accounts it must never touch.

A threshold nobody agreed to gets argued about during an outage. Agreeing on it up front is the point.

## Some things have no approver

The Azure team carries four hard limits: never delete outside the decommission workflow, never grant Owner or User Access Administrator, never weaken a security control, and never touch break-glass identities. The last three are refusals, not gates. The team declines them and escalates to a person, because an approval button implies the action is available with a click.

## Then it audits itself

Once active, the team checks every Azure write from the day before against an approved change, every weekday at 08:00. The most serious finding that routine can produce is an unapproved change made by the team itself, and it's escalated the same day.

That's what switched off on arrival buys you: a team you can hand real access to, because you set the rules before it used them.

## Questions people ask

How long does discovery take? It depends on how many systems are connected and how quickly your approver reviews the plan.

Can I change the approval thresholds later? Yes. The thresholds live in the operating plan, and changing them is a decision a person makes and the audit log records.

What does a team do before it's activated? Only discovery. Agents read what their read access allows, map how you work, and draft the operating plan. They do no outward-facing work until you approve it.

Watch a team go from import to its first approved change. We'll onboard a team on a real environment and walk through its discovery, plan and first approval.

## Read next

- [Azure Platform Engineering](https://avispa.ai/agent-teams/azure-platform-engineering/)
- [Agent teams](https://avispa.ai/agent-teams/)
- [Glossary: human approval gate](https://avispa.ai/faq/)
- [Book a demo](https://avispa.ai/book-a-demo/)

[All posts](https://avispa.ai/blog/) · [Next: Why we built Avispa](https://avispa.ai/blog/why-we-built-avispa/)

## See it on your own use case.

[Book a demo](https://avispa.ai/book-a-demo/) · [Watch it work](https://avispa.ai/#watch)