Where To Draw The Line On Agentic AI's Autonomy

Vivek Ahuja, VP of Technology at rSTAR, focused on enterprise AI, architecture, and measurable business outcomes.

As enterprise AI tools move from answering questions to taking action, leaders face a decision that goes beyond selecting the right model: How much authority should an AI agent have?

Consider a customer calling a utility about an unusually high bill. An agent could review usage, compare previous bills, identify a rate change and explain the difference. It might also recommend a payment arrangement.

But should it enroll the customer automatically? Waive a charge? Change account settings? Giving an agent access to information does not automatically mean it should have permission to act on that information.

I believe enterprises need to spend more time defining these autonomy boundaries before agents enter everyday operations. As Deloitte’s research from January 2026 notes, close to three-quarters of surveyed companies planned to deploy agentic AI within two years, yet only 21% reported a mature model for agent governance.

Based on my experience guiding organizations across various industries to implement agentic AI, the most difficult challenge for agentic maturity lies in translating governance into decisions people and systems can follow. Here are some strategies that can help in overcoming that hurdle:

Start with the action and its consequences.

First, I would avoid assigning one autonomy level to an entire agent.

A customer service agent may perform several activities, each requiring different controls. Retrieving an account balance is different from issuing a refund. Drafting a maintenance recommendation is different from changing equipment settings.

For each action, I would ask four questions:

• What happens if the agent gets this wrong?

• Can the action be reversed, and at what cost?

• Does it affect a customer’s rights, safety or financial position?

• Is the action clearly covered by an approved business rule?