Before an AI Agent Enters a Live Workflow, Finish These Five Sentences

Capabilities tell you what an agent can do. Authority defines which judgments the organization has actually delegated.

An AI agent reads customer complaints, ranks them by urgency, drafts responses, and routes cases to different teams.

The product team may describe that as summarization and workflow automation. But ranking determines whose complaint receives attention first. Routing determines which team sees it. A draft may become the final response once employees learn to approve it without rereading the original complaint.

The agent's functional capabilities have quietly become business decisions.

Product specifications describe capability. Permissions describe access. Risk registers describe possible failure. None necessarily defines the judgment the organization has delegated.

The authority gap

That boundary is often left to emerge after launch. Operators learn which recommendations are usually accepted. Managers learn which exceptions slow the workflow down. The system gradually takes on more authority, not because anyone approved a broader role, but because repeated behavior made that role normal.

When the boundary is implicit, teams can govern the model while leaving the delegation of judgment unresolved.

Before an AI agent enters a live workflow, make the team finish five sentences.

• The agent may decide...
• The agent may recommend...
• The agent may initiate...
• A human must approve...
• The agent must stop when...

1. The agent may decide...

A decision is something the agent may resolve without additional human judgment before the consequence occurs.

The answer should be narrow enough that everyone can recognize when the agent has crossed the boundary. "The agent may decide routine cases" is not a useful answer.

• What makes a case routine?
• Who defined that category?
• Which facts must be present?
• What happens when the facts conflict?

Sample answer: The agent may assign a complaint to one category from an approved taxonomy when all required information is present and no escalation condition is detected.

The point is not to eliminate flexibility. It is to make the delegated judgment visible.

2. The agent may recommend...

"Recommend" is safe only when a person still exercises independent judgment before acting.

Sometimes a recommendation really is advisory. Sometimes it is a decision wearing softer language. The difference is not the label. The difference is how the workflow operates.

A recommendation remains a recommendation only when the reviewer has:

• Access to the original evidence
• Enough time to review it
• Authority to disagree
• A clear basis for overriding the recommendation
• Accountability for actually exercising judgment

When employees approve outputs by habit, the agent is no longer merely recommending. When the agent determines which evidence the reviewer gets to see, it may already have shaped the decision before the human arrives.

A human click is not the same thing as human judgment.

3. The agent may initiate...

Starting a process can create real consequences before anyone reviews the underlying judgment.

Initiation is easy to underestimate because it sounds procedural. But each action changes what happens next.

• Create a case
• Assign a priority
• Route work to a team
• Send an acknowledgment
• Request additional information
• Place an item into enhanced review

The team should distinguish between actions that are easily reversible and actions that affect a customer, employee, applicant, patient, citizen, or business partner before human review occurs.

Name the steps. Name the conditions. Name what the agent may not trigger on its own.

4. A human must approve...

"Human in the loop" is not an operating design. It is a placeholder.

A useful approval rule identifies:

• Which role approves
• What that person must review
• Which evidence must be available
• What criteria guide the approval
• What authority the person has to override or stop the process
• What gets recorded about the decision

The human cannot be accountable for a decision while lacking the information or authority required to make it. The approval point also needs to occur before the meaningful consequence, not after the system has already acted.

5. The agent must stop when...

Every agent needs a defined boundary where automation gives way to escalation.

"Stop when confidence is low" is rarely enough. Confidence in what? Measured how? Against which threshold? What if the model is confidently wrong?

Stop conditions should be tied to observable operating conditions:

• Required information is missing
• Sources conflict
• The request falls outside the approved use case
• A legal threat or safety concern is detected
• Discrimination or protected-class issues appear
• The proposed action exceeds an approved threshold
• The agent cannot retrieve a required source
• Operating conditions materially differ from those under which the system was approved

A stop condition without an escalation destination is also incomplete.

• Who receives the case?
• What information do they receive?
• What are they authorized to do?
• How quickly must they act?

A worked example

Consider the customer-complaint agent. A practical authority boundary might look like this:

May decide: Which category from the approved complaint taxonomy applies when all required information is present.

May recommend: Urgency, review priority, and the appropriate handling team.

May initiate: Case creation, assignment to a review queue, and a standard acknowledgment confirming receipt.

Human approval: The substantive customer response, remediation, account action, legal determination, or closure of the complaint.

Must stop: A legal threat, safety issue, discrimination allegation, missing evidence, conflicting customer records, or a request outside the approved taxonomy.

Those sentences do not govern the entire system. They create an authority boundary that product, operations, legal, compliance, and risk leaders can inspect together. Once the boundary is visible, permissions, testing, monitoring, escalation, and evidence have somewhere specific to attach.

Run the test before launch

Take one planned or existing AI workflow and finish all five sentences in plain language. Do not begin with the model. Begin with the operating decision.

• Which judgment is being delegated?
• Which judgment remains with a person?
• Which actions may occur before review?
• Where must the system stop?

An unfinished sentence is not merely missing documentation. It is room for the agent, or the people relying on it, to improvise. Governance begins by closing that room before the workflow goes live.