Loading
Should You Give AI More Autonomy?
·4 min read
The question sounds philosophical until a system starts to make decisions and execute tasks you usually do. In May 2026, the World Economic Forum published a paper that named the main problem: organisations are already deploying autonomous AI agents, and most have not defined what those agents are authorised to do. The paper discussed how the problem is no longer whether AI can assist a business, but whether organisations are prepared to properly define, constrain, and continuously supervise what these systems are authorised to do on their behalf. For most companies, the answer right now is no.
Automation Anywhere's August 2026 report on agentic AI governance found that 53 percent of organisations had AI agents exceed their intended permissions, and 47 percent had experienced an agent action they could not fully explain after the fact. A system can stay within its permissions and still do something its operators did not anticipate. Permission boundaries and decision boundaries are different things, and most governance frameworks only address one of them.
In a business context, autonomy is the capacity to run a consequential action without a human authorising it beforehand. A model that drafts an email for a person to then send the email, is not autonomous. A model that sends the email, books the follow-up call, updates the CRM, and commits budget to a campaign it decided was warranted is autonomous, and each of those steps carries a different level of consequence. What separates a well-governed deployment from an ungoverned one is a chain of authority decisions that most organisations have not made explicitly.
The AI Agent Standards Initiative, launched in February 2026, identified exactly this problem: agents are commonly treated as generic service accounts without dedicated identity, authorisation, or accountability controls. A human employee doing the same job would have a role, a manager, a set of approval thresholds, and a paper trail. An AI agent handling the same tasks often has none of those things, because the people who deployed it thought about capability and not about authority structure.
Singapore's Infocomm Media Development Authority moved first on the issue. Its Model AI Governance Framework for Agentic AI, published in January 2026, set out four governance dimensions, with one requirement running through all of them: humans must remain accountable for decisions and actions taken by autonomous systems. Under that framework, organisations take the responsibility regardless of what the system does.
Granting autonomy without granting authority in a defined and auditable way is not a neutral decision. When an agent exceeds its intended permissions, the immediate question is what it did. Who authorised the system to be in a position where it could do that, is the question most organisations are yet to deal with. In that case they have a record of what the agent did because they can retrieve the logs. But they do not know who owns the boundary decision that turned out to be wrong.
EU Regulation 2026/174 on simplification of AI implementation, which entered into force on 2 August 2026, clarified the AI Office's enforcement competence for agentic systems. Combined with the EU AI Act's existing high-risk and transparency rules, authority gaps in agentic systems now carry regulatory exposure alongside operational risk.
A genuine counterpoint here, is that apparently some level of unexplained agent behaviour is inherent to how these systems work. You cannot always predict every consequential decision a sufficiently capable model will make, any more than you can script every decision a senior employee makes in a day. That is, however, not detached from the argument for governance, nor it is against it. So much as a senior employee exercises judgment within defined limits of their authority, approval thresholds, established procedures, and accountability, why shouldn't an agent too? Agent governance must establish equivalent boundaries about what the model can decide, which actions require approval, and when responsibility passes to a human.
Deciding how much autonomy to give AI is less urgent than building an authority structure surrounding that autonomy specific enough that you would know, within an hour, who owns a decision that went wrong. An organisation that cannot answer that question has given its agents more autonomy than its governance can cover.