Safe autonomy is set step by step, not once for the whole agent. For each step, define three things: what the agent is authorised to do and up to what limit, the named person accountable when it acts, and how you would see, stop or undo what it did. Start narrow, log everything, and widen autonomy as the agent earns it.
Start with one decision
An agent drafts a supplier payment. Who approves it? If the answer is “it depends”, you have just found where to start.
“It depends” is a good answer. It means the organisation already knows the limits exist: the amount, the supplier, whether the invoice matches the order. Those limits live in policies, approval matrices and the judgement of the people who run accounts payable today. The work is to write them down, step by step, in a form an agent can follow and an auditor can check.
Three things to define for every step
Authority: what the agent may do, and up to what limit. Be specific. “Approve payments” is not a limit. “Approve payments under a set value to existing suppliers where the invoice matches the purchase order” is. Give the agent only the access the step needs. The UK National Cyber Security Centre puts it plainly in Managing the cyber risk of agentic AI (NCSC, August 2026): “Ensure it has only the permissions it needs for the task being performed and use credentials with the shortest possible lifetime.”
Accountability: the named person who answers for it. One person, by name, for each step the agent can take. They own the limit, review how it is working and decide when it changes. A process with an owner gives you this almost for free. A process without one is the place to begin.
Recovery: how you see, stop and undo what it did. Log every action, so you can show what the agent did and why. Know how you would halt it. The same NCSC guidance says you “should always be able to ‘pull the plug’ and halt autonomous AI agent activity immediately.” And for each step, know whether the action can be reversed and who would reverse it.
Match oversight to consequence
With those three defined, the level of oversight for each step follows from two questions: how much damage would a mistake do, and how easily could you reverse it?
- Low impact, easy to reverse. The agent acts on its own, within its limit, with every action logged and reviewed.
- Higher impact, or hard to reverse. Keep a human gate. A person approves before the agent acts.
- Anything in between. A person monitors and can intervene.
The NCSC describes the last two as human-in-the-loop, where “humans approve actions before they happen”, and human-on-the-loop, where “humans monitor actions and can intervene if needed”. Choose for each step, not for the agent as a whole. The same agent can act alone on one step and wait for approval on the next.
Let autonomy grow as it is earned
Autonomy is not a setting you switch on. Microsoft’s guidance on designing autonomous agent capabilities (Microsoft Learn, 2026) says: “Small, incremental expansions of responsibility are safer than giving the agent too much autonomy all at once.”
A practical sequence:
- The agent proposes, people act. You see what it would have done and how often it would have been right.
- The agent acts on reversible steps within tight limits. People review the log.
- Limits widen where the record supports it. Each change is a decision with an owner and a reason.
On our Process Operating Fit page these sit as two of six operating modes: agentic AI with human supervision, and agentic AI with governed autonomy. Nothing requires a process to move from one to the other. Some steps are best left with people for good reasons.
Review the limits whenever something material changes: the process, the risk, the volume, the agent itself, or after an incident or near miss.
Where IGX fits
Most of what you need to set these limits is already in your organisation: approval matrices, delegated authorities, control tests and process models. We help you bring it together for the processes in scope, see how far you can trust it, and turn it into authority, accountability and recovery for each step an agent will take. Our Agentic AI Readiness page sets out how authority, oversight and recovery fit together.
That is how to trust AI: one decision at a time, with an owner behind each one.
What to do next
Take the first process you plan to give an agent. List every step it could take. For each, write the limit, the owner and how you would stop or reverse it. The steps where you cannot fill in all three are your action list, and turning those gaps into owned actions is the next step.