October 2026
How Much Autonomy Should the Enterprise Give AI Agents?
The decision is not whether agents can act. It is which actions they may take, under whose authority, and when a person must decide.
Executive Snapshot
The Decision
Which business actions should AI agents be permitted to complete independently, which require human approval, and which should remain human-led?
Why Does It Matter?
The value of an agent comes from completing work, not merely proposing it. Yet connecting an agent to enterprise systems can turn a wrong interpretation, excessive permission or missed exception into a customer, financial or operational consequence. Requiring approval for every small action can erase the value of delegation.
ETT View
Grant autonomy selectively, for a named workflow and bounded action. Increase it only when the enterprise can demonstrate reliable performance, enforceable authority, an accountable owner and an effective path to intervene.
Why This Matters Now
The shift from generating an answer to executing an action changes the governance question. An agent may read a record, update a case, trigger a payment or interact with another system on behalf of a person or team. Capability alone does not establish permission to do any of these things.
In 2026, NIST identified agent security and identity as priorities for trusted adoption. Its subsequent identity guidance warns against shared credentials, static tokens and broadly scoped access. NIST Australia’s agentic AI addendum sets out best-practice guidance for government agencies; it is useful to other enterprises as a design reference, not a blanket legal obligation. digital.gov.au
These developments do not establish one universal autonomy threshold. They underline an immediate management task: define the authority granted to each agent in the context of the work it actually performs, and make that authority enforceable when actions occur.
"Autonomy should be granted where authority is bounded, evidence is strong and intervention remains practical."
The Executive Decision Framework
Apply these five tests to a specific workflow and proposed action, not to an agent product in the abstract. Failure on a material test should limit autonomy until the gap is resolved.
1.Consequence
Question: What could happen if the agent takes this action incorrectly, repeatedly or at scale?
Why it matters: Retrieving information and preparing a draft carry different consequences from changing a record, contacting a customer or committing funds. The appropriate level of autonomy depends on the impact of an error, how quickly it would be detected and whether it could be reversed.
Evidence to look for: A list of proposed actions; assessed customer, financial, privacy and operational impacts; transaction limits; and actions that require approval or remain prohibited.
2.Authority
Question: Can the agent’s access be limited to the actions, systems and time period required for this task?
Why it matters: An agent may be capable of completing a task without being authorised to use every route available to it. Broad or shared credentials make it harder to enforce boundaries and establish who authorised an action.
Evidence to look for: A distinct agent identity; a named business owner; scoped and time-limited permissions; separate read and write rights; and controls that reject actions outside the approved scope.
3.Reliability
Question: Has the agent performed well enough in this workflow to act without routine approval?
Why it matters: A successful demonstration says little about ambiguous instructions, unusual cases or misleading inputs. The relevant measure is the quality of the completed business outcome, including corrections and review effort.
Evidence to look for: Tests using representative work and exceptions; agreed error thresholds; results from a supervised live period; and comparison with the existing process.
4.Accountability
Question: Who owns the outcome, and where must a person approve or intervene?
Why it matters: Delegating an action does not delegate responsibility for its consequences. Approval should sit at consequential decision points, with an escalation path that works when the agent encounters an exception or a reviewer is unavailable.
Evidence to look for: An accountable business owner; explicit approval and escalation triggers; trained reviewers; response times; and tested ways to pause, override or reverse actions where possible.
5.Control Evidence
Question: Can the enterprise reconstruct, monitor and contain the agent’s actions in operation?
Why it matters: A control described at approval may fail when the agent uses tools or encounters unexpected conditions. Leaders need evidence of what the agent attempted, what it was permitted to do and what changed as a result.
Evidence to look for: Action records linked to agent identity, authorisation and outcome; monitored exceptions; periodic permission reviews; incident exercises; and a tested way to disable the agent.
Proceed Selectively
Authorise agents to recommend and prepare work broadly where the information and use case permit it. Allow independent execution first for bounded, low-consequence, reversible actions with measurable value and enforceable controls. Require explicit human approval for material financial commitments, sensitive external communications or consequential customer and employee outcomes unless a more specific, defensible authority model has been proven. Some decisions should remain human-led.
Ask each workflow owner to document the permitted action, limits, evidence threshold and stop condition before production access is granted. Review performance and exceptions over a defined operating period. Increase autonomy only when the benefit persists without unacceptable error, hidden review effort or control breaches. This is a delegation decision, not a one-time endorsement of an agent platform.
Leadership Questions
Which exact actions are we delegating, and what would be the consequence if the agent took each action incorrectly or at scale?
Who owns the outcome, and can they show that the agent’s identity, permissions and approval thresholds are enforced during execution?
What evidence would cause us to expand, reduce or withdraw that authority—and how quickly could we stop the agent if necessary?
Signal to Watch: Exceptions at the Action Boundary
As agents move from drafting to acting across connected systems, the point where a proposed action becomes a real-world change becomes the critical control boundary.
Completion counts can rise even while inappropriate attempts, manual corrections or unseen control failures increase. The quality of delegation is revealed by what happens at that boundary.
The proportion and severity of attempted actions blocked, escalated or later reversed, alongside the percentage of consequential actions with an identifiable owner and a complete action record. Rising exceptions or incomplete records should trigger a review of permissions and autonomy before expansion.
Agentic Governance: Why Enterprise AI Changes the Rules of Governance
In this ETT conversation with Jesper Lowgren, the key distinction is between reviewing governance before deployment and making it effective while an agent acts. The discussion explores why identity, boundaries, traceable decisions and human escalation belong in the operating model—not only in a policy document.
https://www.enterprisetechtalk.com/episodes/agentic-governance-enterprise-ai