Let agents make decisions without it backfiring
An AI decision rights framework gives every decision an agent touches one of four rights: recommend, act with approval, act within limits, or act alone.
Each right comes with a named owner, written limits and a tested kill switch. This playbook shows how to assign rights by risk and reversibility, with cases from C.H. Robinson, Coinbase, Westpac and Stripe.
This playbook belongs to Agents, traceability and evals.
Why now
Agents now make customer-facing decisions inside large incumbents. C.H. Robinson’s agents determine and send ocean and air freight quotes, while customs brokers keep validation and compliance (October 2026). Spotify auto-merges a defined class of automated maintenance pull requests, the vast majority with no human in the loop (June 2026).
Regulated firms are already putting agents to work. In the Bank of England’s October 2026 survey of UK financial firms, 80% run agents in production for decision support, where the agent recommends and a person decides, and 46% already let agents execute within set constraints. Moving a decision from one level to the next is a governance question.
A Harvard Business School working paper on 202 enterprises (October 2026) shows what the leaders do differently. Top-quartile firms report recurring production evaluations far more often than bottom-quartile firms, 63% against 4%.
2–3 min
per ocean or air quote, down from one to three days (C.H. Robinson)
26%
shorter median compliance review (Stripe)
List the decisions, then the agents
Write an inventory of decisions agents touch or could touch: quote a price, approve a credit line, merge a code change, answer a customer, flag a compliance risk, reorder stock. For each, record weekly volume, value at stake, how reversible it is, and whether a regulator cares.
One agent often touches several decisions with different risk. Rights attach to decisions, so the same agent may act alone on one and only recommend on another.
The step produces a decision inventory with volume, value at stake, reversibility and regulatory exposure per decision.
| Right | What the agent does | Example |
|---|---|---|
| Recommend | Prepares the file; a person decides and acts | Zurich underwriting triage |
| Act with approval | Acts after a person approves | Coinbase changes touching money movement |
| Act within limits | Acts alone inside written thresholds and scope | C.H. Robinson ocean and air quotes |
| Act alone | Acts and reports; people review samples | Spotify maintenance auto-merges |
Separate what an agent can do from what it may do
Decide separately what an agent can do and what it is allowed to do. A July 2026 paper on allowed and capable autonomy describes five levels, from reactive execution to delegated operational authority, assigned by risk, reversibility and readiness. Its deployed data-engineering agent was deliberately held below its capability.
Use four rights in practice: recommend, act with approval, act within limits, act alone. JPMorgan describes the same progression for treasury agents: insight, signal, recommendation, execution, with autonomy earned step by step (June 2026).
The step produces one right assigned to each decision in the inventory.
“…anything affecting the movement of money still receives thorough human testing and approval,” said Arize AI on Coinbase Wallet, August 2026.
Draw the line by risk and reversibility
High-volume, reversible, low-value decisions can move up the ladder fast. Irreversible or regulated decisions stay with a person, and the agent prepares the file.
Coinbase has a security agent assign each code change a risk level. Changes touching the movement of money get thorough human testing and approval; lower-risk changes pass through agent review councils (August 2026). Cursor reports that agents create 75% of Coinbase’s pull requests (June 2026). Westpac’s five lending agents read payslips, run the calculations and check them against policy, and the banker keeps the credit decision. Westpac says the agents saved 12,500 banker hours in their first month of operation, July 2026 (AFR, August 2026). Zurich’s agents turn broker submissions into a decision-ready file for underwriters and cut manual submission triage time 80% (vendor case, September 2026).
The step produces a decision-rights map with the human line drawn for every decision.
Write the limits into the workflow
Limits that live only in a policy document get crossed. IBM’s “least privilege and least agency” rule: grant an agent only the data, tools and decision rights the task needs, and enforce policy during execution (September 2026). A J.P. Morgan treasury paper describes approval thresholds, payment holds and sweep triggers written once as machine-readable code that can be versioned and tested, with agents logging every decision and its rationale (June 2026).
Stripe breaks each compliance investigation into small pre-tested sub-tasks, logs every tool output, and leaves the decision to human reviewers. Median review handling time fell 26% (June 2026). Octopus Energy’s Arlo never handles vulnerable customers, sensitive cases or complex complaints, labels every AI-written email, and hands over to a person on request. (July 2026).
The step produces a machine-readable limits file per agent, enforced at runtime.
“Employees set goals, review results, and retain responsibility for decisions,” said Deutsche Telekom, October 2026.
Earn autonomy in shadow mode
Before an agent acts, run it on live cases with zero write access and compare its recommendations with what people decided (Microsoft, July 2026). Promote the right only when agreement holds over a defined period and volume.
For consequential decisions, MIT’s Initiative on the Digital Economy suggests an agent charter that states whose interests the agent serves, what it may decide alone and what it must escalate, plus an escrow step that holds the decision and its reasoning for review before execution (September 2026).
The step produces a promotion threshold per decision: agreement rate, period and volume.
Give every agent an identity, an owner and a kill switch
Every agent gets its own identity stamped into logs, permissions approved by security, and traffic through a policy gateway (Google Cloud, October 2026). IBM’s October 2026 release gives each agent a governed identity with short-lived credentials that can be revoked in real time when the agent steps outside its approved permissions.
The Financial Stability Board’s October 2026 practices ask firms to attribute every action and escalation to a specific agent, test kill switches that range from full stop to graceful degradation back to human operation, and spot-check logs against actual actions. Siemens’ contact-centre agent escalates to a person with full context whenever it cannot resolve a call.
The step produces an agent register: identity, owner, rights, limits and a tested kill switch for each agent.
Review rights every month
Decision rights change over time without anyone deciding to change them. When agents turn past cases into reusable lessons, a temporary exception can become a standing rule (CIO.com, October 2026). Separate better execution, which the process owner approves, from changes to business rules, which need the decision owner.
Deutsche Telekom states the way it aims to redesign work in one line, quoted below. Mollick’s “Twilight Factory” adds the other half: agents should call people for approval, expertise and variance of thought, and a design that leaves humans only approvals and exceptions is one to avoid (August 2026).
The step produces a monthly rights review with promotions, demotions and rule changes recorded.
Do this week
- List the ten decisions agents already touch in your company, including pilots.
- Assign each one of the four rights and a named owner.
- Check that each agent in production has its own identity and a kill switch someone has tested.
Measure
| Metric | How to measure | Target direction |
|---|---|---|
| Decisions with an assigned right and owner | Share of inventoried decisions with both | Up |
| Shadow agreement rate | Share of shadow-mode recommendations matching the human decision | Up |
| Escalation rate | Share of agent cases handed to a person, per decision | Stable or down |
| Override rate | Share of agent actions reversed by a person | Down |
| Kill switch tested | Days since the last tested stop per agent | Down |
| Unapproved rule changes | Learned behaviours that changed a business rule without approval | Zero |
Questions
What is an AI decision rights framework?
It is a written map of every decision agents touch, with the right each agent holds on it (recommend, act with approval, act within limits, act alone), the person who owns the outcome, the limits enforced in the workflow and the way to stop the agent. It is reviewed monthly, and rights move up only on measured evidence.
When should we let an AI agent act autonomously?
When the decision is high-volume and reversible, the agent has matched human decisions in shadow mode over a defined period, limits are enforced in the workflow, and a named owner reviews samples. Spotify auto-merges a defined class of maintenance changes. Coinbase keeps human approval on anything that moves money.
What does human in the loop mean in practice?
It means a named person holds a specific right at a specific point. At Westpac the banker keeps the credit decision. At Zurich agents prepare a decision-ready file and underwriters decide. At C.H. Robinson customs brokers keep validation and compliance. A vague promise of oversight with no named gate gives no protection.
Who should own agent decision rights?
The executive who owns the business outcome owns the rights for that decision, with risk and legal approving the limits. The HBS study of 202 enterprises found that top-quartile firms run recurring production evaluations far more often than bottom-quartile firms. Agent operations staff run the register and the kill-switch tests.
