Loading
The AI Authority Framework: How Much Decision-Making Should You Give an AI Agent?
·9 min read
In the spring of this year, an interesting AI-adoption "reversal" took place inside enterprise technology planning. Gartner named agentic AI oversight its top cybersecurity concern for the year, and it's because organisations were extending authority to agents faster than building control to govern them. At the same time, IDC projected that agentic AI would drive the majority of IT budget expansion over the next five years, reaching $1.3 trillion by 2029. Money was flowing toward agents while the governance structures needed to give the last call to humans is not there yet. Every operator deploying agents today faces a similar situation and has to make a core decision: how much of a specific action, on a specific class of outcome, should the organisation trust an agent with?
When an agent acts wrongly on a decision it fully owns, the cost lands differently than when it acts wrongly on a decision a human approved. One is a system error. The other is an authorisation error, and fewer than 1% of executives currently report AI return on investment above 20%, while 40% of agentic AI projects are expected to be cancelled before 2027. Agents deployed without a clear authority structure tend to produce outcomes nobody planned for and nobody can explain after the fact, which helps explain reports on low returns and the expected cancellations.
First, we need to make an important distinction between two words: AUTHORITY vs AUTONOMY , even though almost no one talking about AI and Agents rarely, is talking about this. Authority is what a system is permitted to decide. Autonomy is how independently it executes once permitted. We can give an agent broad authority and low autonomy, and route it through human approval at every step. We can also give it narrow authority but high autonomy, where it acts without review on a selected class of decisions. Most organisations conflate the two. They give an agent a wide tool set, and assume that a light approval requirement by a human is enough to cover any risk, only to discover later that the approval was too shallow to catch what went wrong.
That conflation between AUTHORITY and AUTONOMY of agents does its most damage at the design phase. Once an agent is live in a workflow, the effective authority it holds is often larger than people intend it to be, simply because tools accessible to the agent compound. An agent with access to a customer database, a communication API, and a payment processor can be unintentionally granted authority to contact a customer, change their account status, and initiate a financial transaction, even if no one framed it that way when they built the agent.
MIT's Human Data Science Review frames the agentic AUTHORITY/AUTONOMY calibration problem assuming that autonomy levels should track decision reversibility and the organisation's risk tolerance, not the general category of task. Design that anchors on reversibility locates the actual cost of an error rather than the apparent severity of the domain.
So for example when customer service agent that closes a support ticket incorrectly creates a minor nuisance, but if the same agent is authorised to issue a refund, cancel a service, or flag an account for fraud review, when it makes the wrong decision, it makes it harder for a human to backtrack. The ticket is reversible with a click. The fraud flag travels downstream into credit systems, partner databases, and compliance records before anyone reviews it. In a high-volume operation, an agent running thousands of decisions per hour can propagate an error through a system faster than a human audit cycle catches it.
On the upside, we have cases where companies used more than one agent at scale successfully. Take One New Zealand for instance, the telecommunications provider. They operated more than fifty AI agents simultaneously by early 2026, according to MIT Sloan Management Review. What made it viable was not how many agents they used but the architecture behind them: They mapped the agents capability to make specific decisions by predictability and reversibility before any agent was granted authority over them. Predictable, reversible decisions ran autonomously, and unpredictable or irreversible ones triggered human review. The same agent technology, under a different architecture, would have produced a different outcome.
The Singapore IMDA Model AI Governance Framework for Agentic AI, Version 1.5, published in mid-2026, introduces a concept it calls action-space: the range of actions an agent can physically take, determined by which tools and permissions it holds. Action-space and authority are not the same thing. An agent's action-space is set by its integrations; its authority is set by governance decisions a human made. Where those two boundaries diverge, accountability breaks down.
In a multi-agent system, the divergence between the two boundaries compound. A coordinating agent delegates a task to a subordinate agent. The subordinate holds tool access that was granted for a different purpose, under a different workflow. The original authorisation decision, made by a human the week before, no longer maps to the action the subordinate is now taking. Singapore's framework requires each agent to carry a verifiable digital identity and an audit trail naming which agent acted under whose authorisation at each step. Without that, tracing an error through a chain of delegated agents becomes a forensic exercise conducted after consequences have already landed, rather than an operational check that can stop them.
The Authority Resolution Framework, a 2026 working paper, addresses this directly. Its core finding is that at any moment of consequential action, the system needs a clear answer to two simple questions: who permitted this, and who owns the outcome if it is wrong. In a human organisation, those two roles are often held by the same person. In an agentic system, they come apart, and the governance structure has to hold them together by design.
The approach we found most useful is to work backwards from each action the agent will be able to take. List every external-facing or internally consequential action: such as API calls that modify records, communications sent under the organisation's name, financial transactions initiated, data accessed or shared. For each, ask two things: can I reverse this action if the agent messes up, and how predictable is the agent's making a correct decision given the information it will have access to at decision time?
When decisions are both reversible and predictable, they can then be part of a full autonomy level of permission. Decisions that are irreversible or unpredictable must warrant human approval, a constrained action-space, or both. The ResearchGate paper on governance and strategic risk in autonomous organisations calls this separating decision ownership from outcome ownership, and argues for governance structures that track both explicitly rather than assuming they align. Authority allocation can be misaligned from the onset before anything goes wrong, whenever the agent has full ownership of the decision, while the human only owns the outcome.
The NIST Center for AI Standards and Innovation, which launched its AI Agent Standards Initiative in February 2026, came to a structurally similar conclusion in its work on AI standards: the organisation that grants an agent authority must hold a legible record of what it granted, under what conditions, and what triggered any change in those conditions. An authority record that cannot be understood from the logs tells you nothing when an agent acts in a way no one expected, and legibility then becomes an operational requirement before it is a compliance one.
In Europe for instance, the EU AI Act, Regulation (EU) 2024/1689, makes human oversight a requirement for high-risk AI systems under Article 14, with those provisions applying from August 2026. Article 14 does not require a human to approve every output. It requires a human to be able to understand what the system is doing, intervene when necessary, and stop it if needed. These are three distinct capabilities, yet many oversight arrangements provide one without clearly establishing the other two.
The ability to understand an agent's actions is often overlooked. An operator who can stop an agent but cannot reconstruct how it reached a decision has limited control over its behaviour. By the time a problem becomes visible, the agent may already have acted on that decision. The [Singapore IMDA framework](https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf) addresses this through audit trails: records showing which agent acted, what it did, and whose authorisation it operated under. These records allow humans to examine decisions, challenge them and intervene before the consequences spread.
A study discussed in MIT's Human Data Science Review offers a useful example of how to divide responsibility. The agent handled detection, analysis and communications autonomously, while a human retained authority over the final decision. Giving the agent that final authority would also have allowed it to make high-stakes decisions in situations where the right course of action was genuinely ambiguous. The agent could handle the work quickly; the human retained the decision that carried the greatest consequences.
Human oversight requires more than a stop button. A person must be able to understand an agent's actions, challenge its decisions and retain control over the choices that carry the greatest consequences.
Organisations building agentic workflows are effectively making two products simultaneously: the agent and the authority architecture around it. The architecture determines what the agent can do, what it cannot do without approval, and who carries the outcome when it acts. Built well, that architecture is what makes an agent trustworthy enough to run in a real operation. Built badly, or not built at all, the agent is an automation with a wide action-space and no clear line of accountability.
The organisations already running agents at volume, including One New Zealand's deployment in early 2026, share something the 40% of cancelled projects probably did not: they mapped authority before they mapped capability. How much the agent could do was never the governing question. The governing question was which class of action, with which reversibility profile, the organisation was prepared to own the outcome of.
Building an agent for real work involves more than making it capable. Companies must also decide what the agent can do independently, when it needs human approval, and who is responsible for the outcome. These decisions determine whether the agent can be trusted with real work. Without clear boundaries, even a very capable agent can take actions nobody intended, with no clear line of accountability.
One New Zealand's deployment in early 2026 offers an example of agents entering real operations. The important question is not simply how much an agent can do, but which decisions it can make on its own. Routine, reversible actions may need little oversight. Decisions with serious or lasting consequences call for tighter controls and, in many cases, human approval. The more difficult an action is to undo, the more carefully its authority needs to be defined.