The question most operators are actually asking is not what an agent can do. It is what happens the first time it is confidently wrong at three in the morning.

The line is reversibility, not difficulty

It is tempting to divide work by how hard it is, and to assume the hard parts need a human. That is the wrong axis. Plenty of hard work is safe to automate because a mistake shows up immediately and costs a rerun. Plenty of trivial work is not, because a mistake is silent and permanent.

The useful test is what it takes to undo the action. If undoing it requires a phone call to a counterparty, a correction filed with a regulator, or an apology to a client, a person approves it first. If undoing it requires pressing the button again, the agent can own it.

Three categories that always stay with a person

  • Anything that moves money or changes who controls an asset. The reversal cost is not the amount, it is the relationship and the record.
  • Anything that creates a legal or contractual obligation, including sending a document that a reasonable person would read as a commitment.
  • Anything that cannot be undone at all: a deletion, a public statement, a filing, a message to someone who now knows something.

Approval only counts if it binds to the exact thing shown

This is where most implementations quietly fail. A person is shown a summary, approves it, and the system then executes against data it re-fetched afterwards. The approval and the action are now two different things, and the audit record says a human approved something that never happened.

The correct behaviour is that the approval attaches to a specific, frozen payload. If anything about it changes between the approval and the execution, the system does not adapt. It stops and asks again. That constraint is inconvenient roughly once a month and it is the entire reason the record is worth anything.

The system should be able to refuse

An agent that cannot complete a required check has two options: guess, or stop. Most systems are built to guess, because stopping looks like failure in a demo. In a regulated environment, stopping is the feature. A pipeline that halts and says which check it could not complete is doing its job; one that proceeds on partial evidence has quietly transferred the risk onto whoever signs the file.

This is also the honest answer to the question operators ask about AI and headcount. The judgement does not go away and neither does the person exercising it. What goes away is the preparation: the gathering, the cross-referencing, the assembling of the file that used to consume the hours before the decision. The decision itself stays exactly where it was.