AI agents in business change who can authorize action

AI agents in business make delegated authority a software configuration. A connection can allow a system to change a customer record, send a message or initiate a transaction. Once that connection is live, an incorrect result may affect another party before a person reviews it. The permission decision therefore belongs in the operating design from the start.

An action-capable AI system combines a model with tools that interact with business software. The product label says little about how much authority the connection grants. A tool described as an assistant can have broader access than an agent that operates behind a mandatory approval step.

The emerging question is which business commitments a company can delegate while retaining a reliable account of what happened. This Looking Glass analysis examines that shift through technical mechanisms and bounded operating scenarios. It makes no forecast about adoption rates or employment. Its test is what additional evidence would justify the next increment of authority.

What authority should AI agents in business receive?

Authority should be defined at the action level. Reading a contract, drafting an amendment and sending the amendment to a counterparty require different permissions. A procurement leader may welcome help locating a renewal clause while retaining approval over every change to the commercial commitment.

Anthropic's 2024 analysis of agent architectures describes systems with different degrees of model-directed execution. A business should evaluate the actual execution path and tool access rather than infer behavior from the product label. The relevant evidence is what the software can do in the environment where it will run.

Use an action register to connect each tool permission with a business consequence. The register should identify the record affected, the limit of the change and any approval required. It also needs a recovery classification. An internal draft can usually be corrected before anyone relies on it. Information sent to a customer may be impossible to retrieve, even when a follow-up message can correct the error.

Delegating a bounded action can still produce value. For example, a system might prepare a purchase request using approved supplier information while leaving final approval with a buyer. The additional work required for autonomous ordering should be justified by its incremental benefit and the evidence that the company can control it.

The integration can fail after the model gets it right

A model can select the correct next action while the surrounding system supplies an outdated record. That failure is difficult to detect if the demonstration uses clean information that production does not consistently provide. The deployment assessment needs to examine how records are updated, who resolves conflicting sources and what happens when an integration is unavailable.

An illustrative customer-service workflow shows the problem. A refund policy allows a particular remedy, but the payment system has already processed it. If the system cannot identify the earlier transaction, a correct reading of the policy can still produce a duplicate refund. A unique transaction reference and a destination check address a different failure from improving the model's answer.

Evaluation should therefore include the action and the resulting state. Anthropic's 2025 guidance on agent tools describes evaluating tool use in context. For a business deployment, that means checking that the intended record changed correctly and that a retry cannot silently repeat a completed action.

Exception handling creates a capacity limit. If each difficult case reaches the same senior employee, increasing automated volume can lengthen the review queue. Measure the arrival rate and time required to resolve those cases before granting more authority. A system needs an explicit behavior when the queue is full, such as pausing that action class or returning work to the established process.

Recovery evidence should determine the next permission

Act now on decisions that remain useful across products. Name the process owner, define approved information sources and document which actions require approval. Those steps improve the manual process as well as an automated one, and they reduce the ambiguity that a future implementation would otherwise inherit.

Test next where the task has a clear completion condition and a manageable consequence of error. A controlled trial can compare a proposed action with the decision an experienced employee would make. Record disagreements and the evidence used to resolve them. A disagreement about policy should lead to a policy decision rather than an instruction to imitate whichever employee answered last.

The next useful signal is evidence from the proposed operating environment. Watch for reliable recovery from interrupted actions, lower review effort without weaker checking and stable results after configuration changes. A vendor benchmark can justify investigation. It cannot establish those conditions for the company's own records and permissions.

NIST's 2024 Generative AI Profile extends its risk-management work to generative AI. The implication for this analysis is continuing review: a launch decision depends on the system, use and operating conditions assessed at that time.

Approve the additional action explicitly

An expansion proposal should state the additional action, expected benefit and evidence supporting the change. It should explain how the operator detects an incorrect result and which consequences remain difficult to reverse. That gives management something more concrete to approve than a general request for a more autonomous product.

The agentic AI launch checklist provides a practical structure for that evidence. The ownership discussion addresses the people who must maintain the decision after deployment. Neither replaces technical testing, but both prevent operating responsibility from disappearing between teams.

A company can retain supervised execution indefinitely where the consequence of error warrants it. Where it proposes automatic action, the approval should identify exactly what additional authority is being granted and why the evidence supports it. Ask for the action register and the last successful recovery test. If either is missing, keep that action supervised until the gap is resolved.