What should an AI agent be allowed to do in our business?

Give an AI agent enough authority to remove real work, but not more authority than the risk justifies. In practice that means letting it act on its own where a mistake is cheap, visible, and easy to undo, requiring a person's approval where a mistake is expensive or permanent, and widening its authority only after it has earned it.

Companies get this wrong in both directions. Some give an agent broad access because the demo looked good. Others require a person to approve every step, which turns the agent into a slower way of doing the work yourself.

What is the difference between an agent that answers and one that acts?

An assistant that answers questions reads information and tells you something. The worst case is a wrong answer that a person then acts on. That risk is real, but a person still makes the decision.

An agent that acts changes something. It creates a record, updates a status, sends a message, moves money, or starts a process. Now the agent is making the decision, and its mistakes land in your systems and in front of your customers.

Most of the value is on the acting side. Most of the risk is too. So the useful question is not whether an agent should act. It is which actions, with what checks around them.

Which actions can an agent take on its own?

Actions that are routine, reversible, and visible. If the agent gets one wrong, someone notices and fixes it before it costs anything.

At a specialty healthcare client, the operations team runs its shipping process through an AI agent. They ask it to create a patient record, start a shipment, or update operational data, and it does, with no separate approval step. That works because the system around it is strict. Status changes are validated, duplicates are blocked before they are created, and anything unusual surfaces as an exception for a person to handle. The agent can move quickly because the guardrails live in the system, not in a person checking every request.

If every one of those updates needed sign-off, the team would have saved nothing. Requiring approval for routine, reversible work does not make it safer. It moves the work back to a person and adds a queue.

Which actions need explicit approval?

Actions that are expensive, permanent, external, or hard to see once they happen. Payments and refunds. Anything sent to a customer, a regulator, or a partner in your name. Deleting data. Changing who has access to what. And anything that becomes the official record other decisions depend on.

That last category is the one people miss. I built Capital Record, an application that gives AI assistants long-term memory about a person's investments. The AI can suggest context, like why something was bought or what would change the view. It cannot make that context part of the record on its own. The person approves it first, because an AI's interpretation of what someone believes should not quietly become the record of what they believe.

The same rule runs through an investment research system I built. Agents gather evidence and propose assumptions. A person approves the assumptions. Then the valuation runs on fixed, repeatable calculations rather than a model's arithmetic. The agents do most of the work, and the person keeps authority over the numbers that drive the decision.

What has to be in place before an agent can act?

Three things, and they matter more than which model you choose.

Permissions scoped to the job. The agent gets access to the systems and actions its responsibility requires, and nothing else. An agent that updates shipment records does not need access to payroll.

A record of what it did. Every action should be logged with what changed and why, so a person can review it and reverse it.

A path for exceptions. The agent needs a defined way to say "this one needs a person" instead of guessing. Good agents escalate the unusual cases. Bad ones handle them confidently and wrongly.

If you cannot say who can see what the agent did, how you would undo it, and what happens when it is unsure, it is not ready to act on its own.

How should we expand what an agent is allowed to do?

Start narrow. Give the agent one clear responsibility, watch it work, and measure how often it is right. When its error rate is low and the errors it does make get caught, widen its authority one step at a time.

It is the same way you bring on a new employee. Nobody gets signing authority on day one. They get a defined job, someone reviews their work for a while, and their authority grows as they prove they are reliable. An agent should earn its authority the same way.

The order matters too. Expand into actions that are more frequent before actions that are more consequential. An agent that reliably handles hundreds of routine updates a week has earned more trust than one that got a single high-stakes call right.

Where do companies get this wrong?

Usually by writing the policy before looking at the work. "A human must approve everything the AI does" sounds responsible and makes most agents pointless. "Let it handle everything" sounds efficient until the first confident mistake reaches a customer.

The better approach goes action by action. What does this step cost if it goes wrong? Will we see it? Can we undo it? That produces three short lists: what the agent does freely, what it needs approval for, and what it never touches. Those lists belong in your AI governance policy, next to who decides when an item moves from one list to another.

If you are deciding what an AI agent should handle in your operation, that is a conversation worth having before the build starts.