Where To Draw The Line On Agentic AI's Autonomy

Vivek Ahuja, VP of Technology at rSTAR, focused on enterprise AI, architecture, and measurable business outcomes.

gettyAs enterprise AI tools move from answering questions to taking action, leaders face a decision that goes beyond selecting the right model: How much authority should an AI agent have?

Consider a customer calling a utility about an unusually high bill. An agent could review usage, compare previous bills, identify a rate change and explain the difference. It might also recommend a payment arrangement.

But should it enroll the customer automatically? Waive a charge? Change account settings? Giving an agent access to information does not automatically mean it should have permission to act on that information.

I believe enterprises need to spend more time defining these autonomy boundaries before agents enter everyday operations. As Deloitte’s research from January 2026 notes, close to three-quarters of surveyed companies planned to deploy agentic AI within two years, yet only 21% reported a mature model for agent governance.

Based on my experience guiding organizations across various industries to implement agentic AI, the most difficult challenge for agentic maturity lies in translating governance into decisions people and systems can follow. Here are some strategies that can help in overcoming that hurdle:

First, I would avoid assigning one autonomy level to an entire agent.

A customer service agent may perform several activities, each requiring different controls. Retrieving an account balance is different from issuing a refund. Drafting a maintenance recommendation is different from changing equipment settings.

• What happens if the agent gets this wrong?

• Can the action be reversed, and at what cost?

• Does it affect a customer’s rights, safety or financial position?

• Is the action clearly covered by an approved business rule?

These questions help business and technology teams decide where independent execution makes sense and where approval is necessary.​

• Act independently. The agent completes a defined action within approved limits. For example, it could send a routine status notification after confirming the recipient and underlying information.

• Prepare for approval. The agent gathers evidence, recommends an action and presents it to an authorized employee. A billing adjustment outside standard limits might follow this path.

• Stop and escalate. The agent encounters conflicting policies, missing information or a situation beyond its authority. It pauses the affected action and transfers the case to a person.

The same workflow may use all three. An agent could investigate a billing issue independently, prepare an adjustment for approval and escalate a policy conflict.

Those boundaries should be enforced through system permissions, transaction limits and approval controls. Instructions in a prompt should not be the only thing preventing an unauthorized action.

“Keep a human in the loop” sounds reassuring, but it only becomes meaningful when someone is available, authorized and equipped to intervene.

An escalation should also explain what triggered it, what information the agent used, what actions it already completed and what decision remains open. Otherwise, the employee has to reconstruct the case, so the automation has simply moved work to another person.​

In a May 2026 article on agentic AI and manager oversight, Gartner recommends predefined intervention points and explicitly allocating time and authority for human oversight. I agree with this, but I would also define what happens while approval is pending. Does the workflow pause? Can unaffected steps continue? Who receives the case if the primary reviewer is unavailable? An unanswered approval request needs a defined outcome.

I would be cautious about using an agent’s stated confidence as the main trigger for human review. As others have noted, confidence does not always correlate with accuracy. From what I’ve seen, a confident recommendation may still rely on outdated information, an incorrect assumption or a policy that does not apply.

An escalation should therefore consider observable conditions: missing records, conflicting sources, unusual transaction values, repeated failed attempts or actions outside approved limits.

In the billing example, for instance, conflicting account ownership information should trigger review even if the agent presents its recommendation confidently. The business consequence should influence the boundary alongside evidence quality.

To determine where to grant agentic autonomy, I would start with a narrow workflow and evaluate how the agent behaves before expanding its authority.

Did it complete the task correctly? Did it stay within its permissions? Did it recognize exceptions? Could the team reconstruct what happened and recover when something failed?

An agent that correctly pauses an ambiguous transaction may be performing exactly as intended. Measuring only completion rates or reduced human involvement could encourage the wrong behavior.

As performance becomes more predictable, leaders can expand specific permissions. Changes to policies, systems or the model should prompt another review of those boundaries.

Finally, every agent-enabled workflow needs a named business owner. IT can implement controls, but the business must help define acceptable outcomes, approval thresholds and decisions that require human judgment.

Before approving your next agentic AI deployment, ask your team to demonstrate three things: what the agent can do independently, what forces it to stop and how a person takes over. Test those boundaries with a difficult exception rather than only a routine transaction.

If the team cannot demonstrate all three, the agent is not ready for greater authority. Make that your next deployment gate.​​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?