We talk about agents, but work in chat

Asking AI to draft a reply to a client, reviewing it, and sending it yourself is one thing. Asking it to manage that exchange — look up the information, respond, and alert you if a problem comes up — is another. In the first case, you use a chat to help you. In the second, you delegate work to an agent.

I work with AI agents every day and lead a team that builds them. The leap between those two situations isn’t just about AI doing more things. It’s about deciding which things we let it do without asking us.

There’s plenty of talk about that leap, but half of employees admit they have little understanding of what an agent is ¹. The right talent is scarce, agents still fail, and returns take time. But there’s a question no technical improvement can answer: who’s accountable when they act?

If you review and send a reply, you know the decision is yours. If the agent sends it and makes a commitment you didn’t want to accept, who answers for it? You, who asked it to manage your email? IT, which installed the tool? Among European companies that decided against using AI, uncertainty about the legal consequences was the second most common reason ².

Without an answer, IT locks down permissions or the business bypasses governance. At large U.S. companies, 47% admit to having done so out of urgency, and 36% have already experienced an incident with a material impact ³.

The result is visible. But the agent makes decisions along two dimensions that aren’t. The first is risk: what an agent can do is defined by what you allow it to do, not what you ask it to do. In April, a coding agent deleted a company’s production database in nine seconds, backups included, using a credential with more permissions than anyone realized ⁴. Nobody had asked it to do that. It simply could. The second is money: the agent decides how deeply to pursue a task, and with it, how much to bill. You wanted a $10 analysis; the agent decided it deserved a hundred.

We’ve already figured this out when it comes to people. On a new employee’s first day, we don’t give them authority to sign on behalf of the company or a card with no spending limit. But we don’t leave them with nothing to do, either. With AI agents, the debate is still framed too often as all or nothing.

Step-by-step supervision isn’t the answer, either: according to Anthropic, users of its coding agent approve 97% of permission requests ⁵. Asking permission at every step isn’t control. It’s fatigue.

Companies already know how to delegate the authority to act: it’s called a power of attorney. It has a defined scope, limits on signing authority, spending authorizations, and reserved actions that are never delegated. Treating an AI agent as if it held a power of attorney also requires whoever signs that document to understand the authority they’re granting.

The question holding agents back isn’t what they can do. It’s what limits they operate within, and who’s accountable for what they do.