Should We Let This AI Agent Act Without a Human Approving It?

The decision is not whether AI agents should ever act alone. It is whether this agent, on these specific actions, has earned a smaller human gate, and what stands between the agent and the consequence once the gate is gone.

The decision

This question rarely arrives as a strategy paper. It arrives as a request from a delivery team.

An agent has been in service for a few months. It drafts the action, a person approves it, the action executes. It works. And now the approval step is the bottleneck: the queue is growing, the reviewer is spending hours a day clicking approve, and the team is asking for the gate to be removed so the agent can run at the speed it was bought for.

I have written before about the approval decision itself: the business outcome, the authority, the accountability and the evidence an agent needs before it enters service. This is the decision that follows it, usually six months later. The agent is in. It has a record. The question is no longer whether to delegate, but whether to delegate the last step: execution without a person confirming each action.

That makes it a different decision, and a better one. The first approval was made on promises and test results. This one can be made on evidence.

Where leadership teams actually stand

In cyber defence, at least, the hesitation at this step is measurable.

PwC's 2027 Global Digital Trust Insights survey, published in October 2026 and covering 3,934 business and technology leaders across 71 countries, asked how much autonomy leaders would give AI agents in cyber defence. Only 22% would authorise agents to fully execute defensive actions without human approval. 38% would permit partial autonomy, and 36% prefer human-led execution with AI support throughout.

The reasons are not philosophical. 55% rank the reliability and maturity of the technology among their top three barriers to giving agents more autonomy, and 46% cite accountability and explainability. Notably, 44% of chief information security officers name their own workforce's skills in AI oversight as a top barrier: the people closest to the work know that supervising an autonomous system is itself a capability, not a default.

The same survey shows where comfort starts: well-defined, repeatable, recoverable actions. Leaders are most willing to let agents act alone on threat intelligence enrichment (49%), quarantining phishing emails (47%) and malware removal (46%). The survey covers security only, but my inference is that the pattern holds well beyond it: comfort follows reversibility and repeatability, not technical capability.

That is the right instinct, and it points at the real shape of the decision: not one gate for the agent, but a boundary drawn through its actions.

The options

There are three honest answers to the team's request.

Option 1: Keep per-action approval.

Every action continues to pass through a named person before it executes.

This is the right answer while the agent's record is short, while its errors are expensive or hard to reverse, and while nobody can say what the reviewers have actually been catching. It keeps a human judgement in front of every consequence, and it keeps accountability simple.

Its cost is not only throughput. A human approval is a control only while the human genuinely evaluates. At, say, twenty actions a day the reviewer reads each one. At a few thousand, the review becomes a click, and the organisation is paying for a control it no longer has. Volume does not just slow the gate down; it hollows it out.

Option 2: Remove approval inside an enforced boundary.

The agent executes a defined class of actions on its own. The boundary (which actions, which systems, which limits) is enforced technically, in the agent's permissions, not described in a policy document. Anything outside the boundary still queues for approval.

This buys the speed the team is asking for and keeps human judgement where the consequences justify it. Its costs are real: the boundary has to be genuinely enforceable, someone has to watch the agent's behaviour rather than its requests, and errors inside the boundary now arrive at machine speed and in batches. An agent that misreads a condition does not make one mistake; it can repeat the same mistake hundreds of times before anyone notices.

Option 3: Graduated autonomy with re-entry triggers.

Start with the narrowest, most reversible class of actions. Widen the boundary only on operating evidence, class by class. Define in advance the conditions that put the approval step back: an error rate crossing a threshold, a change to the model or workflow, a new system connection, a material shift in the environment the agent operates in.

This is usually the right destination. In PwC's cyber-defence responses, partial autonomy was the largest group's choice (38%). Its cost is management attention. It is a programme, not a switch: someone must own the evidence, the widening decisions and the triggers. Organisations that cannot name that owner should not pretend they are choosing option 3. They are choosing option 2 with better wording.

The evidence that should decide it

Four questions separate an earned graduation from a convenient one. None of them is about the model.

1. What have the reviewers actually been catching?

The approval queue is an evidence machine, and most organisations never read its output. Before deciding anything, pull the record: how many actions the agent proposed in the last quarter, how many a reviewer changed or rejected, and what those interventions were.

The interventions sort into two kinds. Some are real catches: the agent was about to do the wrong thing. Others are taste: the reviewer rewrote a sentence or re-ordered a list without changing the substance. Real catches argue for keeping the gate on that class of action. Taste corrections argue for letting go.

If reviewers changed nothing in thousands of approvals, the record alone cannot tell us whether the agent is ready or the reviewers have stopped looking. Check how the approvals were handled: were the actions examined, and were any sampled later? If the median review takes only a few seconds, that is not meaningful oversight. It is a formality with a salary.

2. What happens when it is wrong?

Autonomy should follow consequence, not capability. For each action class, ask: is the action reversible, within what window, and has the reversal actually been exercised? Not described in a runbook: exercised. Is the blast radius bounded, or can one bad decision propagate into customer communications, financial records or other systems before anyone notices? Agents fail at machine speed; the recovery path has to work at machine speed too.

3. Is the boundary real?

The boundary only exists if the agent's technical permissions enforce it. The agent acts under its own identity, scoped to the approved action class, with limits it cannot influence. If the agent could technically exceed the boundary and is merely instructed not to, the organisation is not removing an approval step. It is removing its only control.

4. What replaces the click?

Removing per-action approval is not removing oversight. It is exchanging one control for others, and the others must exist before the gate goes: monitoring of behaviour against the approved boundary, sampled review of executed actions with someone accountable for reading the sample, alerting on deviation, and a way to stop the agent that halts further actions and safely handles any action already in progress.

For outcomes that must be correct every time, the replacement cannot be a person watching a dashboard. It needs a check the agent cannot influence, such as validation by a separate system, a reconciliation or a limit in the downstream platform, standing between the agent and the consequence.

Regulation points the same way. Article 14 of the EU AI Act requires high-risk AI systems to be designed so that people can effectively oversee them while in use, including the ability to intervene or stop the system, and requires overseers to stay alert to automation bias: the tendency to over-trust a system because it is usually right. Article 14 applies to high-risk AI systems; whether a particular agent falls within that category depends on its intended purpose and deployment, and the high-risk obligations do not apply until 2027 or 2028, depending on the system. The design standard is still worth adopting now, because automation bias is precisely what turns an approval queue into a rubber stamp.

What the approval step is actually for

Strip the anxiety away and the approval step has one job: it puts a judgement the organisation trusts in front of a consequence it cannot afford.

That framing cuts both ways, and leadership teams mostly only apply it one way. Removing the gate from an agent with a thin record is reckless. But keeping the gate on an agent whose reviewers approve everything unread is not caution. It is the appearance of control, purchased at the cost of the throughput the agent was meant to deliver. It is also fragile in a way nobody prices: the organisation believes a human is checking, so nobody builds the controls that would actually catch a failure.

The honest comparison is never “human judgement versus none.” It is a tired click versus a designed control. On that comparison, a bounded, monitored, reversible autonomy is often the more controlled state, not the less.

The question to take into the room

Which actions is this agent asking to take without approval, what did our reviewers actually catch in the last ninety days, and what control replaces the click?

If nobody can produce the intervention record, the decision is premature in both directions: keep the gate, and start measuring what it catches. If the record shows real catches, the gate stays on that class of action and the conversation moves to why the agent is still getting those cases wrong. If the record shows a rubber stamp, removing it is not the brave option. It is the honest one, provided the boundary is enforced, the recovery is tested and someone owns the triggers that put the gate back.

Let the record decide, not the demo and not the anxiety. The agent earned its way into service. Make it earn its way out of supervision.

Sources

1. PwC (2026). 2027 Global Digital Trust Insights: C-suite playbook and findings. Survey of 3,934 business and technology leaders across 71 countries, published 1 October 2026. Accessed 2 November 2026. https://www.pwc.com/us/en/services/consulting/cybersecurity-data-tech-risk/library/global-digital-trust-insights.html

2. European Union. Regulation (EU) 2024/1689 (the EU AI Act), Article 14: Human oversight. Via the EU Artificial Intelligence Act explorer. Accessed 2 November 2026. https://artificialintelligenceact.eu/article/14/