Bounded Autonomy: Governance for the AI Era

Begin with the outcome and the specific decision

Bounded autonomy means giving an AI-enabled system permission to make specified decisions or take specified actions within an explicitly governed scope.

Start by locating the delay, inconsistency, or missed opportunity in the current operation. Then identify which delegation would improve the outcome. Faster document preparation may deliver the value the business needs without transferring approval authority. Where rules already settle the decision, conventional automation may be sufficient.

A useful delegation describes the action, eligible cases, required evidence, permitted downstream effects, and Outcome owner. “Support accounts payable” describes a function. “Mark an invoice as matched when approved checks pass, while preserving separate payment authorization” describes a boundary.

NIST’s AI Risk Management Framework 1.0, published January 26, 2023, places intended scope, documented responsibilities, human oversight, and executive responsibility for AI risk within the same management structure. These are established governance disciplines to apply to the specific work.

In the Transformation Operating Map, this is primarily Phase 2: Design the Operating Model. The leadership choice is where authority belongs. Controls by Design develops how the agreed limits are enforced during implementation and operation.

Use four authority zones within the same workflow

The existing RePerspective Labs authority model provides a practical vocabulary for that choice.

Authority zone	What the system may do	What leaders must settle
Recommend	Assemble evidence and propose an option; a person decides whether the consequential action proceeds.	Who reviews, what evidence they need, and how they can challenge the recommendation.
Act	Execute specified actions without approval of each individual case, while all authorization conditions hold.	Eligible cases, permitted consequences, limits, and recovery arrangements.
Escalate	Pause the affected action and route the case when a boundary condition fails or cannot be established.	The trigger, receiving team, response time, and fallback if review is unavailable.
Never Delegate	Support analysis while final authority over a reserved decision remains human.	Which decisions are reserved and why, regardless of model confidence or routine performance.

A workflow can use all four zones. Recommend is an advisory role; Escalate is a response to a boundary being reached. Never Delegate identifies authority that remains reserved, such as setting enterprise risk appetite or approving an expansion of the system’s own mandate. The zones do not represent a maturity ladder.

The Bounded Autonomy Framework provides the fuller boundary specification. Here, the task is to justify the allocation of authority.

Set the boundary by consequence, context, and recovery

A boundary needs more than a transaction limit or a confidence score.

Follow the consequences across the whole operation

Assess what an action can cause after it leaves the immediate workflow. Changing a supplier record, issuing a customer commitment, or updating a case status may activate other processes. A small permitted action can therefore create a larger commitment than its owner intended.

The same reasoning applies to volume. A tolerable exposure on one case may become unacceptable when the same error repeats across a batch. Leaders should consider cumulative exposure and how far an error can travel before it is detected.

OWASP’s 2026 guidance on Excessive Agency identifies unnecessary functionality, excessive permissions, and excessive autonomy as sources of risk. It recommends preserving authorization scope across chained actions and enforcing permission checks outside the model’s own judgment.

The operating implication is straightforward: every handoff must preserve the original limit on authority. Connecting another system must not quietly enlarge the mandate.

Judge reversibility in business terms

A database change may be technically reversible after its business consequences have become difficult to repair. Restoring a record does not necessarily recover money, reverse a customer’s decision, or repair a damaged relationship.

Ask how quickly an error would be recognized, who could intervene, and what recovery would require. Where consequences develop faster than people can respond, the necessary protection must operate before the action proceeds. A dashboard reviewed later cannot carry that responsibility.

Delay also has a cost. Requiring approval for every low-consequence action may prolong service queues and consume attention needed for difficult cases. The aim is proportionate delegation that improves the complete service, including its exceptions.

Make authority conditional on usable evidence

A sound decision in a familiar case does not establish reliability in a different population, region, or policy context. Define which evidence must be present and authoritative before the system can act.

Conflicting records, an unverified policy version, or a missing prerequisite should change the permitted response. A model’s expressed confidence cannot substitute for those conditions.

This is where knowledge quality becomes an authority question: if the operation cannot establish the facts required for delegation, it must narrow the action or seek human judgment.

Make the invoice boundary unambiguous

Hypothetical operating example — a proposed design, not a reported implementation or measured result.

Consider a finance operation where analysts spend substantial effort assembling invoice evidence and checking routine matches. The proposed objective is to shorten processing time while preserving payment integrity and capacity for disputed cases.

AI could extract invoice details, assemble the purchase order and receipt evidence, and propose a match. Approved validation rules would check the required records, supplier status, relevant tolerances, and duplicate indicators. The original documents would remain unchanged.

For eligible cases, the workflow could mark the invoice matched and route it into the existing payment-approval process. That status would mean only that the specified matching checks had passed. It would confer no authority to release funds.

A new supplier, changed bank details, a suspected duplicate, missing receipt evidence, or a discrepancy outside the approved tolerance would pause the affected path and send the evidence to a named finance analyst. The AI-enabled workflow would have no permission to change supplier banking details, waive required checks, or release payment.

Keeping payment authorization outside this delegation is a design choice for this example. Another enterprise could set a different boundary after evaluating its obligations, controls, and recovery capability.

The crucial review spans the handoff: if a downstream system treats “matched” as permission to pay, the proposed separation does not hold.

The expected benefit is less routine preparation and faster handling of clean cases. To test it, compare end-to-end processing time, rework, incorrect matches, exception age, payment errors, and analyst workload against the baseline. Include implementation, review, support, and control costs. Time released becomes a realized benefit only when the operation uses that capacity productively.

Give the human boundary enough capacity to work

Escalation transfers work and judgment to people. Its viability therefore depends on staffing, competence, available evidence, and the time within which a decision must be made.

A named reviewer who cannot inspect the case before a service deadline is not a workable fallback. Design the backup owner and continuity response before granting authority. Depending on the operation, that may mean holding the affected action, routing work to a staffed alternative, or temporarily reducing automated intake. A missed response deadline must not silently become approval.

NIST’s Generative AI Profile, published July 26, 2024, identifies over-reliance and automation bias among human–AI interaction risks. Human presence alone does not establish effective scrutiny.

My judgment is that review capacity belongs in the delegation decision and its economics. If the business case assumes most reviewers disappear while the operating model depends on their timely intervention, the two designs are incompatible.

People also need authority to challenge an apparently successful result and report a flawed boundary without being treated as an obstacle to adoption. Evaluate whether their interventions improve outcomes. An incentive to approve quickly can undermine the judgment the boundary depends on.

Review the authority as conditions change

A delegation should identify the evidence that would justify retaining, narrowing, or expanding it.

A higher completion rate does not answer that question by itself. It may reflect better performance, easier cases, or fewer exceptions being detected. Examine decision quality and downstream outcomes alongside the amount of work completed automatically.

Before expansion, test the proposed scope under representative conditions, including difficult cases and loss of required data or human availability. Review whether the operation can detect problems, contain their effects, and recover within its commitments.

NIST’s AI RMF, MANAGE 2.4, calls for mechanisms and assigned responsibilities to supersede, disengage, or deactivate systems whose performance or outcomes diverge from intended use. Withdrawal of authority belongs in the original design.

Assign the right to change the boundary explicitly. The Outcome owner should propose scope changes, with risk, control, and technology owners supplying the relevant challenge and evidence. The designated approving authority decides whether to expand the mandate. Operators should have a separate, predefined right to pause affected work within the incident procedure.

A change in policy, knowledge source, system permissions, case mix, or service conditions should trigger review where it affects the basis of authorization. The system may support that review; it should not authorize its own expansion.

Narrowing authority can preserve value when conditions deteriorate. The useful measure of maturity is how reliably the enterprise makes and revisits these decisions.