A predictive model tells you a customer is likely to churn. An agentic system reads the customer's file, drafts a retention offer, checks it against policy, applies it to the account and sends the email. The first is a recommendation you act on. The second is an action the system takes. That shift, from output to action, is the largest change in AI risk since machine learning arrived, and most governance programs are not built for it.
Agentic AI is where this series reaches the frontier. The controls from the previous seven articles still apply, but autonomy adds a category of risk they do not fully address: a system that acts can cause harm at machine speed, chain small errors into large ones, and do things nobody explicitly approved. This article covers what changes when AI acts, the oversight architecture autonomy demands, and how regulators are already framing it.
§ 8.1What autonomy changes
Three things change when a system takes actions rather than making predictions, and each demands a control the predictive world did not need.
Consequence becomes immediate
A wrong prediction sits there until a human acts on it, which is a natural checkpoint. A wrong action has already happened. If an agent moves money, changes a limit or sends a communication, the harm is done before anyone reviews it. Speed removes the human checkpoint that predictive systems had for free. The control autonomy demands is a deliberate re-insertion of that checkpoint where the stakes require it.
Errors compound
Agents chain steps. Each step's output feeds the next, so a small error early can amplify into a large one by the end, and an agent that misreads a situation can take a sequence of actions that each seemed locally reasonable and were collectively wrong. Predictive models fail in place. Agents fail in trajectories. The control this demands is boundaries on the trajectory, not just the individual action.
Attribution blurs
When a human acts on a model's recommendation, accountability is clear: the human decided. When an agent acts autonomously, who is accountable for the action it took at 3 a.m. without anyone watching? The named-owner control from AG-01 becomes sharper and harder here. Someone must be accountable for what the agent does, and the architecture must make the agent's actions traceable to that owner.
The autonomy principle
Match autonomy to reversibility and stakes. An agent may act freely where actions are low-stakes and reversible. It must pause for a human where actions are high-stakes or irreversible. The governance question for any agent is not "is it accurate" but "what is it allowed to do without asking, and where must it stop and wait." Answer that per action type, in the architecture.
§ 8.2The oversight architecture
Human oversight of agents is not one control. It is a spectrum, and the design job is placing each action type at the right point on it.
| Mode | Human role | Fits |
|---|---|---|
| Human-in-the-loop | Approves each action before it executes | High-stakes, irreversible actions: moving funds, denying claims, external communications with legal weight |
| Human-on-the-loop | Monitors in real time, can intervene and halt | Medium-stakes actions at moderate volume where pre-approval would bottleneck |
| Human-over-the-loop | Reviews after the fact; sets policy and bounds | Low-stakes, reversible, high-volume actions where per-action review is impractical |
The mistake is choosing one mode for the whole agent. A single agent may do all three: draft an internal note (over-the-loop), apply a small fee waiver (on-the-loop), and authorize a large exception (in-the-loop, always). Design oversight per action, not per agent. The architecture routes each action to its required oversight mode based on its stakes and reversibility, which you classify in advance.
§ 8.3The four agentic guardrails
Beyond oversight mode, four architectural controls bound what an agent can do. These extend the guardrail layer from AG-07 into the action space.
- Action allow-lists. An agent can only take actions it is explicitly permitted to take. It cannot invent a new capability at runtime. The permitted action set is defined, reviewed and enforced, so the agent's reach is bounded by design rather than by hoping it stays in scope.
- Value and rate limits. Even permitted actions carry ceilings. An agent authorized to issue refunds has a per-transaction and per-period limit, above which it must escalate. This caps the blast radius of any error or compromise.
- Trajectory bounds. The agent's sequence of actions is monitored for the compounding failure. Circuit breakers halt an agent that loops, escalates its own actions, or drifts from its objective. This governs the trajectory, not just the step.
- Full action logging. Every action, its trigger, its inputs and its outcome are logged with attribution to the accountable owner. When you must reconstruct what the agent did and why, the record exists. This is observability from AG-07, extended from inferences to actions.
Worked example
A bank deployed an agent to handle routine servicing: address changes, statement requests, small fee waivers. It classified each action. Address changes and statement requests ran over-the-loop with after-the-fact sampling. Fee waivers ran on-the-loop up to a low ceiling, with anything above it escalated to a human in-the-loop. One day the agent, misreading a batch of similar complaints, started issuing waivers rapidly. The rate limit tripped at the fifth waiver in a minute, the circuit breaker halted the agent, and a human reviewed the batch. The four guardrails turned a potential mass-waiver incident into a five-item anomaly and an alert. No single control would have caught it; the combination did.
§ 8.4How regulators are framing it
US enterprise
Supervisors extend existing expectations rather than writing agent-specific rules. Effective challenge, model risk and accountability all apply, with heightened attention to the control environment around autonomous action. The practical expectation: demonstrate that an autonomous system operates within bounded, monitored authority, with clear human accountability and the ability to halt it. Frame your agentic controls in SR 11-7 language and the story lands.
GCC / MENA
The human-oversight expectation is often explicit, and SAMA and the CBUAE emphasize named accountability and the ability to intervene. Agentic autonomy raises the bar on both. For Islamic-finance products, an agent acting on structuring or pricing may touch Sharia-conformance boundaries, so the permitted-action set must respect those constraints and, where relevant, route to Sharia review. Bound the agent to what is both compliant and Sharia-conformant by design.
§ 8.5Start conservative, widen deliberately
The right posture with agentic AI is to start with narrow autonomy and widen it as you earn confidence. Begin with agents that act only on low-stakes, reversible, high-volume tasks under tight bounds. Instrument everything. As the monitoring data shows the agent behaving within bounds, deliberately widen its allow-list and raise its limits, one reviewed step at a time. Autonomy is not a switch you flip. It is a dial you turn as evidence accumulates, and the architecture from AG-07 is what lets you turn it safely.
Agents deepen your dependence on external model providers, because the most capable agentic models come from a handful of vendors. The next article confronts that dependence directly: third-party risk, concentration, and operational resilience under DORA and its peers.
The shift from output to action is the core change. An agent's mistakes happen immediately, compound across steps, and blur accountability.
Match autonomy to reversibility and stakes. Ask not "is it accurate" but "what may it do without asking, and where must it stop and wait."
Design oversight per action, not per agent: human-in-the-loop for high-stakes and irreversible, on-the-loop for medium, over-the-loop for low-stakes high-volume.
Bound agents with four guardrails: action allow-lists, value and rate limits, trajectory circuit-breakers, and full attributed action logging. The combination catches what no single control does.
Start with narrow autonomy under tight bounds and widen deliberately as monitoring evidence accumulates. Autonomy is a dial, not a switch.