When AI Starts Making Decisions, Where Should Humans Draw the Line?
The important business question is not how autonomous a model appears. It is which decisions an organisation is willing to delegate, who remains accountable and how the system can be stopped when the consequences are wrong.
An announcement is not an operational capability
On 30 September 2026, the US Department of Defense issued a Project Agincourt memorandum setting out a pathway towards an Autonomous Warfare Command, with a stated target date of 1 October 2027. The memo describes a planned organisational direction, not a command already established and operating. The US Army’s public account describes it as an announced initiative.
Military systems and commercial software operate under very different laws, risks and institutions. This article does not equate them. The limited connection is a question of authority: as tools become capable of preparing or executing actions, organisations must decide which decisions may be delegated and who remains responsible.
In business, a tool that drafts a customer reply is doing something different from one that sends it, changes a customer record or issues a refund. Treating all four as “AI automation” hides where the organisation has actually delegated authority.
Capability and authority are separate questions
An AI system may be able to complete an action without being authorised to do so. A CRM integration could technically update a record; that does not mean it should be allowed to change a customer’s credit status. A booking agent might be able to reserve a time; whether it may cancel a high-value appointment is a separate policy decision.
A useful design starts with the business decision, not with a vendor’s description of an agent. Ask what outcome it may commit the organisation to, whose interests may be affected, how costly a mistake would be and whether the action can be reversed. Set a different rule for answering routine opening-hours questions than for making a refund promise or sending a contract.
This decision-rights lens complements existing work on AI agent accountability and verification of AI work. It is not a new technical standard; it is a way to make a business’s own delegation policy visible.
An illustrative five-level business framework
The following five levels are an illustrative Altitude AI framework for discussing decision authority. They are not an official industry standard, legal classification or universal maturity scale. A single organisation may use different levels for different tasks.
- Level 1 — Inform: AI finds or summarises information; a person decides what to do.
- Level 2 — Recommend: AI proposes an action; a person reviews and approves it.
- Level 3 — Prepare: AI completes the preparatory work, such as drafting a report or filling a form; a person authorises execution.
- Level 4 — Execute within limits: AI performs pre-approved actions within defined boundaries, with monitoring, logging and escalation.
- Level 5 — Broad autonomy: AI manages an extended workflow under delegated authority, subject to governance, intervention and clear accountability.
Match permission to the consequence of error
A low-impact, reversible task can often be automated further than an irreversible or sensitive decision. An AI agent might categorise an enquiry, prepare a response and update a non-critical CRM note. It may still need approval before sending a financial commitment, disclosing confidential information, changing an entitlement or contacting someone about a consequential decision.
For each action, specify the allowed records, recipients, values, timing and transaction limits. Make exceptional cases stop and ask for help rather than guess. Identify the human owner who sees escalations and make sure they have enough time and context to review them.
A nominal approval gate is not effective if staff are expected to accept every suggestion instantly. Reviewers need access to the relevant source information, a clear reason for the recommendation and a practical way to reject or correct it. The organisation remains accountable for how work is delegated.
Test authority as carefully as accuracy
During a pilot, record the proposed action, the data used, whether a person approved it, what happened afterwards and how often work had to be undone. Test unusual inputs and supplier outages. Measure completed work and customer or operational outcomes alongside accuracy, review time, exceptions and reversals.
Set a pause mechanism and a rollback route before granting the system access. Keep credentials and permissions limited to the actions it actually needs. Reassess the delegation when the workflow, model, data source or supplier changes; approval of one version does not automatically approve a wider mandate.
The goal is not maximum autonomy. It is useful delegation at a level the organisation can supervise, explain and correct. Give an AI system only the authority that the task, evidence and available controls justify.