Every conversation about AI agents in the enterprise eventually arrives at the same question: how much autonomy should we give them? The question sounds responsible. It is also the wrong one.
It imagines autonomy as a dial that runs from copilot to fully autonomous, with safety at one end and value at the other. Pick your point, accept your tradeoff. The argument never resolves because the frame guarantees it can't. Functions that move money have never governed authority with a dial, and they should not start for the machines.
The oldest control in the enterprise
No CFO personally approves every payment. No CPO signs every purchase order. Enterprises solved the problem of trusting others with money long ago, and the solution wasn't trust. It was structure: delegation of authority, approval thresholds, segregation of duties, audit trails. An analyst can commit the company to ten thousand dollars, a director to a hundred thousand, and the board to everything above that. Authority scales with track record and shrinks with risk, and every exercise of it leaves a trace someone can check.
Nobody calls a delegation of authority matrix a limitation on the workforce. It is what makes a workforce deployable.
The enterprise has run autonomous agents for over a century. They are called employees, and the instrument that governs them is the delegation of authority.
AI agents do not need a new philosophy of control. They need to be written into the oldest one the enterprise has. The moment you see it that way, the paralyzing question of how much to trust the model dissolves into a question every controller already knows how to answer: who may do what, up to how much, on what evidence.
The most governable worker you ever hired
Write agents into that framework and something unexpected surfaces: the machine is easier to govern than the process it joins.
Most enterprise controls exist because human work is opaque. People forget to document. Judgment varies by person, workload, and time of day. Reconstructing why a decision was made six months ago means archaeology across inboxes and memory. So companies wrap human work in reviews, samples, and audits, all of them compensating for the same gap: you cannot see how the work was done.
A well-built agent system inverts that. Every proposal arrives with its evidence chain attached: the contract clause, the invoice lines, the price history, the arithmetic. Every action is logged, and the agent never gets tired of writing the audit trail, because the audit trail is not extra work. It is the work. Policy gets applied the same way on a quiet Monday morning and in the last hour of quarter close.
Be precise about what makes this true, because none of it is automatic. These are properties of the system built around the agent, not of the agent itself: evidence lineage, permissions, logging, and calculation layers that are designed in rather than hoped for. And a complete log proves only what happened; the evidence standard behind it is what makes the action right. Both have to be built. The point is that they can be, which is more than most human workflows can claim.
This reframes the usual anxiety. The reasonable fear about AI in finance-grade environments is loss of control. Done properly, the result is more control than the human-only process ever offered: the approver sees everything, not a summary assembled from three systems by someone in a hurry.
Authority follows the decision, not the model
So how much should an agent be allowed to do? The honest answer: it depends on the decision, not on the model. Autonomy is not a property of the technology. It is a property of the action being taken, and three questions settle it. How reversible is the action? How strong is the evidence behind it? And how has this system performed on exactly this work before?
| Observe | Surfaces findings with the evidence attached | Continuous, within its permissions |
| Prepare | Assembles the case and drafts the action | A human decides to proceed |
| Act on approval | Executes after explicit sign-off | The default wherever money moves |
| Act and report | Executes within pre-approved bounds, fully logged | Bounded, reversible actions; authority earned and reviewed |
The ladder will look familiar, because it is exactly how organizations extend authority to people. A new hire recommends before they decide. Authority expands as the track record accumulates, and it expands per activity, not globally. An agent can earn act-and-report authority on routine, reversible corrections while remaining at act-on-approval for anything that touches a supplier relationship. Nothing about this is exotic. It is a delegation conversation, and companies have one every time they hire.
Concretely: an agent notices that a negotiated price change never made it into invoicing. Observing, it surfaces the discrepancy with the contract language and the affected invoices attached. Preparing, it quantifies the exposure and drafts the recovery claim. With approval, it files the claim. And once enough of these have gone through cleanly, correcting the same class of error inside pre-set limits becomes act-and-report. What it never does, at any rung, is renegotiate the terms. Anything that touches the commercial relationship stays with a person.
The analogy does have limits, and naming them is part of the design. An agent moves at machine speed, so one bad rule can fire a thousand times before a person would have made the same mistake twice. Its behavior can shift when a model or tool underneath it is updated. And accountability never transfers to it; that stays with the people who granted the authority. This is why act-and-report comes with safeguards a human's authority rarely needs: per-action and cumulative limits, exception triggers, and a scheduled review where the authority is re-earned rather than assumed. The delegation is familiar. The bounds are stricter, and they should be.
An approval that is always yes is not an approval
The design has one failure mode worth naming, and it is not the runaway agent. It is the rubber stamp.
Flood a person with a hundred approvals a day and they will approve all hundred, read or unread. At that point the control has become theater: autonomy without design, wearing a compliance costume. The opposite failure is just as real. Escalate everything and the queue becomes the bottleneck, the agents idle behind a human latency, and the program quietly dies of friction.
A human who approves everything is not a control. He is a queue.
The craft is in the middle: routine and reversible actions run within pre-approved bounds, while genuine judgment calls arrive rarely, with complete evidence, framed for a real decision. The measure of a good approval system is not how many approvals it generates. It is that every approval it generates deserves a human's attention. That is a design standard, and it should be held as seriously as any other control standard in the company.
Who writes the agent's authority
One principle from the first essay in this series carries over whole: technology governance can be enterprise-wide, but outcome ownership cannot. IT should govern the platforms, the models, and the security envelope. Risk, legal, and audit should set the boundaries nobody may cross. But what agents may do, at what thresholds, on what evidence: that is written by the functions that carry the number, because they own the outcome and they understand the risk. Finance and procurement have written delegation of authority for people for decades. Writing it for agents is the same work, on a subject that never resents the paperwork.
Three questions, the same ones asked of every human hire: What may it do? Up to how much? On what evidence? Answer those per activity, review them as the track record grows, and the autonomy question answers itself.
The dial was never autonomy
The companies that get the most from agentic AI will not be the ones that grant the most autonomy. They will be the ones that design the best approvals: authority matched to reversibility and evidence, escalation reserved for real judgment, every action leaving a trail an auditor would envy. Get that right and the machine does the finding, the preparing, and the executing at a scale no team could staff, while human judgment concentrates on the decisions that actually need it.
And the way in is smaller than the steering committee imagines. Pick one workflow. List every action an agent could take inside it. Give each action a rung on the ladder, set the evidence it requires, and put a review date on the calendar. That is the whole method. It scales by repetition, not by proclamation.
Autonomy was never the dial. Authority is. And the enterprise has known how to grant authority for a hundred years. ◆