What should your AI agent be allowed to do?

An AI agent that prepares an invoice and an AI agent that makes the payment for it do not need the same authority.

How much autonomy to grant is not just a leadership question. What matters is where it pays off, and where a mistake creates liability for the organisation.

The OWASP Top 10 for Agentic Applications 2026 recommends avoiding unnecessary autonomy, defining permissions, and obtaining human confirmation for high-impact actions.

Reading and modifying are different. Preparing a draft and sending it are different. Recommending something and committing the organisation to it are different. Each needs its own designed boundary.

Choose a workflow. Make clear what the AI agent may read, change and send. Grant only the access that workflow needs.

Build in a step that obtains explicit approval before payments, deletions and other high-impact actions. Show the action about to be taken before asking for approval.

Keep an audit trail. Test failure scenarios, including whether access can be revoked and the workflow stopped.

Start with a pilot that only prepares drafts. Expand autonomy only when measured results and tested controls justify it.

A beautifully written answer is not proof of a safe action. Pairing useful capability with clear accountability is responsible AI design.

In your organisation, which actions should an AI agent never take without human approval?