“The agent may not decide that” is not a setting in a system. It is a statement about a particular step in a particular process – and that is exactly where it belongs.
The question is usually asked wrongly
In most discussions it sounds like this: How much autonomy do we give the AI? That already spoils the answer, because it asks for a number where a list is needed.
Autonomy is not a property of the agent. It is a property of the task. The same agent may complete one process step on its own and only propose at the next – not because it became less capable in between, but because the consequences differ.
It is not the agent that gets an approval level, it is the step.
Three levels are enough
Introduce more than three levels and you get a matrix nobody maintains. Three are enough if they are clearly separated:
1 On its own
The agent acts and completes. No human sees the result beforehand.
When defensible: When a mistake surfaces at the next step and can be corrected without harm. Example: generating a model from workshop notes. If it is wrong, the business sees it immediately.
2 Submitted for approval
The agent prepares everything, a human approves. Without approval nothing happens.
When required: When the result has an outward effect or lands in another system. Example: creating issues in Jira, publishing a Confluence page, handing a specification to a supplier.
This level is the most underestimated. It is not the compromise between the other two – it is the normal case.
3 Ruled out
The agent may not even propose.
When mandatory: When the decision assigns responsibility or affects people. An agent may not grant a role, give an approval, or sign off an acceptance.
Why an agent never carries the A
Under RACI, A means someone answers for it. That attribution assumes you can hold the person to account – that they bear consequences, can change their mind, can refuse.
None of that applies to an agent. An agent carrying an A creates a gap that looks like an assignment.
The rule: R, C and I are permissible for agents. A is not. Whoever deploys an agent carries the A for that deployment.
Incidentally, this is the only rule of its kind that can be checked technically: a model can report where an agent carries an A. Everything else takes judgement.
The four questions before classifying
| Question | If the answer is unfavourable |
|---|---|
| Who notices a mistake – and when? | If nobody notices in time: not on its own |
| What does the correction cost? | More than the saving: put approval in front |
| Does the result have an outward effect? | Yes: approval, no exception |
| Does it assign responsibility to someone? | Yes: ruled out |
Four questions answered in five minutes. They spare you the debate of principle, because they are held at the concrete step.
What goes wrong in practice
The level sits in the configuration instead of on the process
If the approval requirement is set in the tool, only whoever operates the tool knows about it. On the process step, everyone looking at the process sees it – and it survives a change of tool.
Approval as a click without a look
Anyone confirming twenty approvals a day checks none of them. Too many approval steps are more dangerous than too few, because they feign safety. Better a few real approvals than many clicked ones.
Nobody revisits the classification
What needed approval a year ago may run on its own today – and the other way round. Without a fixed date for review, every classification ages quietly.
In short
Autonomy belongs on the step, not on the agent. Three levels are enough: on its own, submitted for approval, ruled out. And one rule holds without exception: an agent carries no A.
Read on:
Escalation and AI agents ·
RACI – who decides, who is heard ·
Governance and compliance
Leave a Reply