Delegated authority for an AI agent is a written agreement that sets out what the agent may decide on its own, what needs human approval, what data it may use, and who is accountable when it gets something wrong. Without one, an agent cannot safely move from pilot to production, because nobody can say who owns the outcome when it fails.
The same idea appears under several names: agent decision rights, bounded autonomy, an agent operating mandate, human-in-the-loop thresholds and an AI delegation of authority. Whatever the label, the question it answers is the one Luise Freese puts at the centre of her work: who owns this when it breaks?
The standards bodies have already answered part of that question. ISO/IEC 42001:2023 requires top management to assign and communicate roles, responsibilities and authorities for the AI management system. The NIST AI Risk Management Framework (AI RMF 1.0) treats documented roles and accountability as core to its Govern function. For high-risk systems, the EU AI Act (Regulation (EU) 2024/1689) requires deployers to assign human oversight to people with the competence, training and authority to exercise it.
The cost of leaving it undefined is visible in the data. 86% of organisations delayed AI agent rollouts by an average of six months (Source: AvePoint, State of AI Report, 2026). Gartner predicts that over 40% of agentic AI projects will be cancelled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls (Source: Gartner, 2025).
This piece builds on a recent conversation with Luise Freese on agents, governance and AI that actually ships.
Why are AI agents a board-level governance issue?
AI agents are a board-level issue because they act, not just answer. A chatbot that gives a wrong answer is wrong in a contained way: a person reads it and decides what to do. An agent that updates records, routes cases or triggers payments can repeat the same mistake across thousands of transactions before anyone notices. The error stops being an incident and becomes a systemic failure. Whether anyone would notice in time is a separate question, covered in our board guide to AI agent incident reporting.
That shifts the risk from the technology function to the organisation’s control environment, which is where the board already carries accountability. As agents multiply, the question becomes one of board design as well as control; we explore that in When AI Agents Outnumber Your Teams.
Why can’t a steering committee own an AI agent?
A steering committee cannot own an AI agent because oversight is not ownership. As Freese puts it, “a committee does not wake up when an automated process fails.” A committee can review, challenge and approve. It cannot diagnose a failure at two in the morning, roll back a bad change or decide whether to switch the agent off. Those are operational decisions, and they need a named person with the authority to make them.
Most stalled agent programmes have plenty of oversight and no owner. The fix is not more governance meetings. It is fewer, clearer names.
What should a delegated authority for an AI agent contain?
A delegated authority should contain the agent’s decision rights, its approval thresholds, its data boundaries, its evidence trail and its named owners. Freese’s example is a service-desk agent that may classify requests but routes uncertain cases to a person, drafts responses but does not send them, and updates metadata but never deletes documents. In practice:
| Element | What it defines | Example |
|---|---|---|
| Decides alone | Actions the agent may take without approval | Classify and route incoming service requests |
| Needs approval | Actions that require a person to confirm | Send a customer response; issue a refund |
| Thresholds | Limits that trigger escalation | Low confidence, or a value above an agreed figure |
| Data boundaries | What the agent may read, change or never touch | Update metadata; never delete documents |
| Evidence trail | What is logged, and for how long | Every action, input and escalation recorded |
| Fallback | What happens when the agent fails or is switched off | Work reverts to the manual process; rollback tested |
| Named owners | Who is accountable for outcome, technology and operation | A business owner, a technical owner and an operational owner |
Note the order. The business decides which decisions the agent should influence and which carry unacceptable risk. Only then does the technology team configure access. Decision rights come first; technical permissions follow.
The AIPEX view: agents need a delegation of authority, just like money does
Every well-run organisation already has a delegation of authority matrix for spending. It says who can commit how much, and who must countersign above that. No CFO would let a new manager spend without one. Yet organisations routinely give AI agents the ability to act on customers, records and payments with no equivalent document at all.
At AIPEX we recommend treating agent authority exactly as the board treats financial authority: written down, approved at the right level, reviewed on a schedule, and tested when something goes wrong. This framing does two useful things. It gives the board a familiar instrument rather than a new technical one. And it makes the question of ownership unavoidable, because a delegation with no named delegate is plainly incomplete.
How should governance be built into delivery rather than bolted on?
Governance should be designed in from the start, not applied as a review after the agent is built. When decision boundaries, data rules, logging and escalation paths are agreed during design, the delivery team builds them into the system, and compliance becomes evidence the system produces automatically. When they are left to a final review, governance becomes the reason the project stalls.
Freese describes this as governance-as-code: rules enforced by the delivery pipeline rather than debated in meetings. Done this way, compliance accelerates delivery instead of vetoing it. It also funds itself only if the budget allows for it, which is why operational funding for monitoring, maintenance, model updates, incident handling and user training has to be agreed when the agent is approved, not when the pilot budget runs out.
What does a production-ready AI agent look like?
A production-ready AI agent is one that knows what it is allowed to do, not one that can do everything. Before an agent goes live, the executive team should be able to confirm each of these:
- Named owners for the outcome, the technology and day-to-day operation.
- A clearly scoped workflow, not an open-ended remit.
- A written delegated authority, approved at the right level.
- An agreed operating model and an operational budget.
- Governance built into delivery, with an evidence trail.
- Tested rollback and escalation routes.
- A regular review of the agent’s behaviour against business outcomes.
If your organisation needs a single accountable executive to put these in place, a Fractional Chief AI Officer can own the programme through the transition. The Executive Strategy Day produces a draft delegated authority for your first agent. For the wider pattern behind stalled agents, read AI Pilot Purgatory, and for the step-by-step route to live, see The 90-Day Route from AI Pilot to Production.
Frequently asked questions
What is delegated authority for an AI agent?
Delegated authority for an AI agent is a written agreement that sets out what the agent may decide on its own, what needs human approval, what data it may use and who is accountable when it gets something wrong. For a full explanation, see Who Owns the AI Agent When It Breaks? Delegated Authority for Boards →
Why can't an AI steering committee own an AI agent?
A steering committee cannot own an AI agent because oversight is not ownership. A committee can review and approve, but it cannot diagnose a live failure, roll back a change or decide to switch an agent off; that needs a named person with authority. For a full explanation, see Who Owns the AI Agent When It Breaks? Delegated Authority for Boards →
Why do AI agent projects stall before production?
AI agent projects usually stall because nobody at executive level owns the transition from pilot to production, and no one has agreed what the agent is allowed to do or who funds it once it is live. For a full explanation, see AI Pilot Purgatory: Why Successful Pilots Never Reach Production →