Before you deploy an AI agent into any real business process, one question has to be answered: what is this system actually permitted to do? Not what is it capable of doing. Not what you'd like it to do eventually. What is it authorised to do, right now, without a human reviewing each step?
Most organisations running AI pilots can't answer that question clearly. Not because they haven't thought about it — but because no single person owns the answer.
The permission problem
An AI agent operating in a business context will encounter decision points constantly. It will need to decide whether to approve or reject something, proceed or pause, notify a human or handle it autonomously. The criteria it uses to make those decisions — and the boundaries around what it can and can't do — are its operating permissions.
If those permissions aren't defined explicitly before the agent runs, one of two things happens. Either the agent is so constrained it can't do anything useful, or it operates on implicit assumptions that haven't been reviewed by anyone with accountability for the outcome.
"Undefined permissions aren't neutral. They're a decision made by default — and the default is usually wrong."
What an operating permission actually looks like
A well-defined agentic permission answers four questions:
- What can it approve autonomously? e.g. invoices under $5,000 from approved vendors with matching POs.
- What must it escalate? e.g. anything above threshold, anything with a policy flag, anything from a new supplier.
- What can it never do? Hard stops — actions the agent is architecturally prevented from taking regardless of context.
- What trail does it leave? Every decision logged, timestamped, and attributable — so a human can reconstruct exactly what happened and why.
These aren't policy documents. They're operating constraints built into the system — enforced by the architecture, not assumed from a memo.
Who owns the answer
This is the governance question that most organisations defer — and deferring it is itself a risk decision. The person who owns agentic permissions needs cross-functional authority: they need to understand the business process, the risk appetite, the regulatory context, and the technical implementation well enough to set boundaries that are actually enforced.
That's the Chief Agentic Officer function. Not to write the permissions in isolation — but to own the framework that produces them, and to be accountable when they're tested.