Before you hire an AI agent, decide what it is allowed to do.

A task description is not an operating boundary.

“Help the sales team” sounds straightforward until an agent starts changing CRM records, sending messages, or proposing terms. A goal describes the outcome you want. Authority defines which actions the system may take to get there. Before a pilot reaches a live workflow, name the business owner and describe the permitted actions in ordinary language. Separate reading information, drafting a recommendation, and committing a change. Those are different levels of responsibility.

Identity needs to survive delegation.

NIST’s August 2026 discussion of agent security highlights identity and authorization weaknesses that model-only guardrails do not resolve. [1] Our practical implication is to treat an agent as an accountable participant in a workflow, with scoped access and an identifiable owner. Avoid giving it a shared human credential merely because that is the fastest integration. Define what happens when it delegates to another agent, encounters new data, or reaches a tool outside the original task. The permission boundary should not expand simply because the model found another route.

Approval is useful only when review is possible.

Human review can become a ritual if hundreds of requests arrive without context. Put approval at meaningful decision points and show the reviewer the proposed action, supporting information, and likely consequence. Use routine rules where the decision is predictable. Reserve agents for work that benefits from interpretation or flexible planning. Before increasing autonomy, test failures: duplicate updates, incorrect records, misleading instructions in retrieved material, and a customer request that exceeds the agreed scope.

Fund the operating model, not just the demonstration.

The launch budget should include evaluation, activity records, usage limits, escalation, and the ability to stop work. Assign someone to review changes in quality and cost. Microsoft’s 2026 Work Trend Index also emphasizes ownership of agent performance and workflow change. [2] These sources do not establish that every agent deployment will succeed. They reinforce a management responsibility: someone must remain answerable for the actions. A useful board question is, “If this agent makes the same mistake one thousand times, who notices, who can stop it, and what can we recover?”