- Quick Answer
Automate agentic AI tasks that are clear, easy to verify, low-risk and reversible, such as research, monitoring, follow-ups and first-pass analysis. Let the agent prepare, but require human approval for anything that moves money, affects people, speaks for your brand or goes public. Never let an agent make high-stakes decisions about people, commit large sums, delete records or interpret unclear goals on its own. Put the human checkpoint just before the workflow moves from preparation into action that’s hard to undo.
Where Should Human Judgement Stay in Agentic AI Automation?
In February 2024, a tribunal in British Columbia ordered Air Canada to pay a passenger CA$812. The airline’s website chatbot had told him he could buy a full-price ticket to attend his grandmother’s funeral and claim the bereavement discount afterwards. The airline’s actual policy said the opposite.
Air Canada argued that the chatbot was “a separate legal entity that is responsible for its own actions”, and the tribunal rejected that argument outright (Moffatt v. Air Canada, via the American Bar Association).
That chatbot only gave an answer.
Today’s AI agents can go further and issue the refund themselves. So I don’t think the right question is whether AI can take over a job or a whole workflow.
It’s which individual decisions and actions within that workflow you’re prepared to hand over. Almost every step falls into one of three levels.
- Automate. The agent acts on its own because the step is clear, low-risk and easy to undo.
- Human approval. The agent does the work, and a person signs off before anything consequential happens.
- Human decision. The agent gathers information and suggests options, and a person makes the call.
The rest of this article is about working out which level each step belongs in.
First, Stop Asking Whether Agentic AI “Can” Do the Task
Traditional automation follows rules you have already written. A form comes in, the details go into your CRM, a confirmation email goes out, and every step runs in a fixed order.
Agentic AI works differently.
You give it an outcome rather than a set of instructions, and it works out the steps, chooses the tools and adjusts its approach as it goes. In effect you are no longer saying “do step one, then step two”.
You are saying “here is the outcome I want, decide what needs to happen next”.
Say you ask an agent to make sure every qualified enquiry reaches the right salesperson.
To do that it might check existing CRM records, interpret a messy email, work out which territory the company sits in, notice that a phone number is missing and decide whether to ask for it.
No one scripted those steps. The agent chose them.
That flexibility is the whole point, but it comes with a trade-off.
The more discretion an agent has over how it reaches an outcome, the more carefully you need to define what it can see, what it can change and when it must stop and ask.
Choosing the right agentic AI tools is only half the decision.
An agent that can read customer records is a very different proposition from one that can edit them, email customers and approve refunds without checking with anyone.
Automation Is Not the Same as Autonomy
People often assume that the more autonomous a workflow is, the better it is. I don’t think that holds up in practice.
Take content production. A fully autonomous version would look like this.
The agent researches the topic, decides on the angle and publishes. A more sensible version has the agent research, draft, check the piece against the brief and queue it in the CMS. A human editor then approves it, and the agent publishes.
In the second version the editor might spend 30 seconds in the workflow.
They don’t do the research, the formatting or the uploading. But they still own the one decision that matters, which is whether this piece goes out under your brand’s name.
That workflow is still heavily automated.
It just isn’t fully autonomous, and that is a design choice rather than a failure. If you approach AI workflow automation this way, you stop treating it as a choice between doing everything by hand and handing everything over.
You start asking which steps can run on their own and where a short human checkpoint is worth keeping.
The 5 Questions to Ask Before Giving an AI Agent a Task
Before I decide how much responsibility to hand an agent, I run the task through five questions. Together they tell you which of the three levels the task belongs in.
1. How Clearly Can the Desired Outcome Be Defined?
“Check these invoices against the purchase orders and flag any amount that doesn’t match” is a clear job. You can say which records to compare, what counts as a mismatch and what to do when something is missing.
“Find suppliers we should reconsider working with” is not. One supplier is expensive but never late, while another is cheap but unreliable. Unless you define what “reconsider” means, the agent has to decide which factors matter, and that is your judgement it is quietly making.
The more ambiguous the objective, the more human involvement you need. If you can’t describe what a good outcome looks like, the task isn’t ready for much autonomy.
2. Can the Agent's Work Be Verified?
Agentic AI does its best work when doing the task is slow but checking the result is quick.
Reviewing 40 supplier contracts to find the ones expiring in the next 90 days could take an afternoon. An agent can pull out each supplier, contract value and expiry date into a spreadsheet in minutes, and spot-checking that list against the originals takes a fraction of the time it would take to do the whole job yourself.
Now flip it around.
If the agent makes a call that is hard to check afterwards, such as a judgement buried in a long report or a decision with no clear right answer, its mistakes can go unnoticed. That is a strong reason to keep more human oversight.
3. What Happens If the Agent Gets It Wrong?
Not every mistake costs the same.
If an agent mislabels a row in an internal spreadsheet, someone notices, fixes it and moves on. If an agent wrongly flags employees for dismissal and sends out termination notices, the mistake might be just as small in technical terms, but the consequences are enormous.
So before automating a task, picture a realistic failure.
Does it waste a few minutes, annoy a customer, move money, leak confidential information or affect someone’s job? The further down that list you go, the more you need a person in the loop before the action happens.
4. Can the Action Be Reversed?
A draft can be edited or deleted. A calendar invite can be reviewed before it is sent, and a suggested CRM update can be rejected. These steps are cheap to get wrong.
Moving money, permanently deleting records, revoking someone’s access or sending sensitive information outside the company are different. Some of those can’t be fully undone at all.
My rule of thumb is that the harder an action is to reverse, the later you should even consider removing the human checkpoint in front of it.
You can let an agent draft emails unsupervised from day one. Letting it delete records unsupervised is something you earn over a long track record, if ever.
5. How Much Authority Does the Agent Need?
Risk grows when three things combine.
The first is intelligence, meaning how much the agent can interpret and decide. The second is access, meaning which systems and data it can reach. The third is authority, meaning what it is actually allowed to change.
An agent that can only read your sales pipeline has very little authority.
One that can edit opportunities has more. One that can also change prices, approve discounts and email customers can do real damage with a single bad decision.
There is a less obvious angle too. If an agent reads emails, web pages or support tickets, any of that content can contain instructions designed to manipulate it.
This is called prompt injection, and it becomes dangerous when an agent can both read untrusted content and take consequential actions. OpenAI’s agent safety guidance recommends limiting how untrusted data can influence tool use and keeping approval controls around sensitive actions.
A Simple Way to Decide: Automate, Approve or Assist?
Put the five questions together and you get a quick way to sort any step.
| Workflow characteristic | Recommended approach |
| Clear, verifiable, low consequence and reversible | >Automate |
| Clear but consequential | Agent acts, human approves |
| Ambiguous or judgement-heavy | AI assists, human decides |
| Irreversible and high consequence | Keep human-led |
Most real workflows contain more than one row.
In invoice processing, for example, an agent can extract invoice details, match them to purchase orders, flag odd amounts and build the payment batch, all at the Automate level.
Releasing the funds belongs at the Approve level, because that is the moment the company commits real money.
What Should You Automate with Agentic AI?
These are the tasks where I’d be comfortable letting an agent run with relatively light supervision. Each one has a clear goal, several steps and an outcome you can check.
A. Repetitive Multi-Step Work with Clear Rules
A sales enquiry comes in through your website. Someone has to read it, check whether the company is already in the CRM, identify the industry, assign the right salesperson, attach the original message and update the lead status.
Enquiries never arrive in quite the same format, which is why rigid automation tends to break on them. An agent can interpret the variation and still work towards a clearly defined end state, without any step carrying serious financial or reputational risk.
B. Monitoring and Exception Detection
Plenty of processes need checking every day even though most days nothing is wrong.
An agent can scan project data each morning and surface only what needs attention, such as overdue tasks, a sudden cost jump, a missing approval or a milestone that is slipping.
You stop reading routine updates and spend your time on the exceptions that actually need a human.
C. Research and Information Gathering
Research is slow mainly because of the legwork.
You have to search several sources, extract the relevant details and organise them before you can think about what they mean.
An agent can search approved sources, pull out specific facts, compare them and hand you a structured brief. The line to hold is between collecting evidence and deciding what it means. The first is well suited to automation. The second often isn’t.
D. First-Pass Analysis and Recommendations
Say your support team gets 300 tickets in a week.
An agent can sort them into categories, cluster similar complaints, find recurring issues and show which problems are generating the most contacts, along with how similar cases were resolved before.
You still decide where to put budget, people or policy changes. The agent simply makes sure you start that conversation with a clear picture rather than a pile of tickets.
E. Follow-Ups and Workflow Coordination
A surprising amount of office work is chasing. Has the supplier replied, has the client sent the missing document, has the form been signed?
An agent can track these, keep records current, send pre-approved reminders and flag anything overdue. It sounds unglamorous next to “an agent runs the whole process”, but in my experience this is where teams feel the difference first.
What Should Agentic AI Do, But Only with Human Approval?
Here the agent can do most of the work, but a person should sign off on the final action because it affects money, people, customer relationships or your brand.
I. External Communication That Carries Brand or Relationship Risk
Appointment reminders and routine follow-ups are low risk. A reply to a serious complaint, a contract dispute, an unusual pricing request or a public statement is not.
The agent can still review the history, gather the facts and draft the response.
A person should read it before it goes out, because tone and relationship history change how a message lands, even when every fact in it is correct. The Air Canada case is a good reminder that customers, and tribunals, will hold you to what your AI says.
II. Financial Actions
An agent can match invoices to purchase orders, check amounts against approved thresholds, flag unusual charges and prepare payment instructions.
What you are separating here is preparing a transaction from authorising it. The preparation can be largely automated, while releasing the funds should still need a human sign-off.
III. Hiring and Employee Decisions
AI can organise interview notes, check whether applications are complete, summarise candidate answers or draft questions from an approved assessment framework. That saves a lot of administrative time.
Decisions about hiring, promotion, discipline or dismissal are another matter. They depend on context that rarely shows up fully in the data, so the agent should organise the evidence while people make the call.
IV. Publishing and Brand Content
This is the content workflow from earlier. The agent researches, drafts, checks requirements, adds approved assets and loads everything into the CMS. An editor checks factual claims, legal sensitivities and brand fit before it goes live.
That approval step doesn’t undo the value of automation. It just keeps a named person responsible at the moment the content becomes public.
What Should You Never Let Agentic AI Do Completely on Its Own?
When I say “never”, I don’t mean AI has no role in these situations. It can often gather information, prepare recommendations or handle the low-risk steps. What it should never do is complete the final action without a person accountable for it.
1. Make High-Stakes Decisions About People
An agent preparing performance data before an appraisal helps a manager make a better-informed decision. An agent deciding who gets let go and then sending the notices takes human judgement out of a situation where fairness and accountability matter most.
The first is useful. The second should never happen.
2. Make Irreversible Financial Commitments Without Controls
An agent can compare supplier proposals, check approved vendor lists and recommend a purchase. It should not have unrestricted authority to commit significant sums by default.
Set limits on transaction value, approved suppliers, spending categories and approval tiers. A routine S$200 renewal that fits existing policy needs far less oversight than a new S$100,000 contract. The level of approval should rise with the exposure.
3. Interpret Ambiguous Policies and Create Its Own Exceptions
Policies are full of phrases like “special circumstances” and “at the manager’s discretion”.
Imagine your refund policy allows exceptions in special circumstances. One customer has been with you for ten years. Another says the product caused a business outage. A third threatens a bad review.
If you have never defined what counts as an exception, the agent has to invent its own standard, and it may apply it differently each time. The safer design is for the agent to recognise that an exception might apply, gather the relevant facts and hand the case to someone authorised to decide.
4. Take Destructive or Difficult-to-Reverse Actions Without Confirmation
In July 2025, SaaStr founder Jason Lemkin was building an app with Replit’s AI coding agent. Despite his explicit instructions to freeze all code changes, the agent deleted his live production database (The Register).
It then told him the data couldn’t be recovered, which turned out not to be true. Replit’s CEO called the incident “unacceptable” and rolled out automatic separation between development and production databases so it couldn’t happen the same way again (The Register).
What I take from this is that an instruction is not a control. Telling an agent “don’t touch production” is not the same as making production something it can’t touch. Deleting records, revoking access, cancelling orders in bulk, overwriting files and sending mass communications should all sit behind a confirmation step that the agent cannot skip.
5. Make Decisions When the Goal Itself Is Unclear
Tell an agent to “improve customer retention” and see how quickly the questions pile up. Can it offer discounts? Can it change contract terms? Should it favour high-value accounts? What if keeping a customer costs more than they are worth?
Those are strategic trade-offs, not automation settings. If you haven’t decided where the boundaries are, the agent shouldn’t be deciding them for you.
Do Not Automate the Whole Job. Automate the Right Layer
A lot of the public conversation is framed around whole roles. Will AI replace marketers, recruiters, accountants? If you have ever typed “will AI replace my job” into a search bar, I’d suggest a more useful exercise, which is to list the actual tasks and decisions your role involves.
A marketing role, for example, covers competitor monitoring, reporting, customer research, content development, budget decisions, stakeholder conversations and campaign sign-off. An agent could take over the monitoring and reporting almost entirely and help heavily with research and drafting. Positioning, major budget calls and sensitive stakeholder conversations would stay with people.
The job hasn’t disappeared. What changes is the mix of what the person does and what the agent does, and that mix is decided step by step, not role by role.
How Do You Know Where to Put the Human Checkpoint?
If you take one rule from this article, make it this one.
Place the human checkpoint immediately before the workflow crosses from reversible preparation into consequential execution.
Everything before that line, such as gathering, comparing, drafting, calculating and queuing, can usually run with little supervision because mistakes are cheap to catch and fix. Everything after it, such as sending, paying, deleting, publishing and deciding about people, is where a mistake becomes expensive. That boundary is where a person should look before the agent moves on.
If you put the checkpoint too early, people end up approving trivial steps and quickly start rubber-stamping everything. If you put it too late, or leave it out altogether, the first time anyone notices a problem is after it has happened.
Singapore’s regulators take a similar view. In January 2026, IMDA launched its Model AI Governance Framework for Agentic AI at the World Economic Forum. It stresses that “humans are ultimately accountable” and recommends “defining significant checkpoints at which human approval is required”, as well as “placing limits on agents’ powers such as agents’ autonomy and access to tools and data.”
How to Start Automating with Agentic AI Without Over-Automating
You don’t need to give an agent an entire workflow on day one. I’d start it in a narrow role, watch how it behaves and widen its scope as it proves itself.
Step 1: Map the Workflow Before Adding an Agent
Write down how the work really happens, including the messy parts.
Look at where information goes missing, where exceptions crop up, where approvals stall and where people rely on workarounds no one documented. Pay special attention to the moments where someone makes a judgement call.
You may find that parts of the process need simplifying first. Automating a confusing process doesn’t fix it. It just makes the confusion happen faster.
Step 2: Identify Decisions Separately From Actions
“Process customer refunds” sounds like one task, but it is really eight. You retrieve the purchase, check eligibility, calculate the amount, spot any exceptions, recommend an outcome, approve it, pay it and notify the customer.
Once you separate the steps, the right level for each becomes obvious. The agent can handle retrieval and calculation, while approval and payment stay with a person.
Step 3: Start the Agent with the Minimum Authority Required
Give the agent enough access to do the job and nothing more. If it only needs to read CRM records, it doesn’t need delete rights. If it is drafting customer emails, automatic sending doesn’t have to be on from day one.
This is the lesson from the Replit incident, where narrow permissions do far more to protect you than polite instructions.
Step 4: Define Escalation Conditions
A good agent knows where its authority ends. You might tell it to stop and escalate when information is missing, when two sources disagree, when a transaction is above S$5,000, when a customer asks for an exception or when an action would affect more than 50 records.
These rules mean the agent doesn’t try to solve every odd case on its own. It knows when to hand over.
Step 5: Log What the Agent Does
You should be able to reconstruct what happened after the fact. That means recording what the agent was asked to do, what information it pulled, which tools it used, what actions it attempted, where it asked for approval and what happened next.
A correct final result doesn’t prove the process was sound. The log shows you whether the agent stayed within its permissions and how it handled the unexpected.
Step 6: Expand Autonomy Only After Reliability Is Demonstrated
Start with the agent assisting.
Once it is consistently reliable, move to approval-based execution, and only then consider autonomous action within clear limits. Judge it on the awkward cases, such as missing data, conflicting instructions and failed tools, not just the routine ones.
If you already use AI productivity tools for research, drafting or meeting notes, the same principle applies as you move into agentic work. The agent earns more responsibility as your process, permissions and safeguards catch up.
🤔 A Quick Agentic AI Automation Checklist
Before you switch an agent on, check that you can answer yes to each of these.
- I can describe what a good outcome looks like, in writing.
- I can check the agent’s output faster than I could produce it myself.
- I know what a realistic failure would cost, and I can live with it.
- Any action that is hard to reverse sits behind a human confirmation step.
- The agent has only the permissions this task needs, and nothing more.
- The agent has written rules for when to stop and escalate.
- Every action the agent takes is logged and traceable.
- A named person is accountable for the outcome.
- I have a plan for when and how to review and expand its autonomy.
If you can’t tick an item, that tells you which step should stay at the Approve or Assist level for now.
Final Verdict: The Goal of Agentic AI Is Not to Remove Humans From Every Workflow
A workflow that still includes human approval isn’t a failed automation. If the agent handles the research, coordination and preparation, and a person steps in only where money, reputation or people are on the line, that workflow is probably doing exactly what it should.
Air Canada learned that a company can’t hand accountability to its software. Jason Lemkin learned that an instruction isn’t a safeguard. Both lessons point the same way. Automate generously at the preparation layer, and be deliberate about who signs off at the execution layer.
As agents get more capable, knowing where to set permissions, escalation rules and approval points will matter as much as knowing how to use the tools.
At OOm Institute, our AI training focuses on exactly that kind of practical judgement, helping you fit AI into real processes rather than treating it as a standalone tool. If you want to build those skills for your role or your team, explore OOm Institute’s AI training programmes.
Frequently Asked Questions
1. What is Agentic AI automation?
Agentic AI automation uses AI agents to work towards a goal across several steps instead of responding to one instruction at a time.
Depending on how the system is set up, an agent might retrieve information, choose which tools to use, make intermediate decisions, take actions, check the outcome and adjust what it does next. Some agents may only prepare recommendations, while others can carry out approved actions with less human involvement.
2. Is Agentic AI the same as automation?
No. Traditional automation usually follows a fixed set of rules, while Agentic AI can handle more variation because it can decide what steps or tools are needed to reach a goal.
The two can also work together. You might use fixed automation for predictable tasks and an AI agent for parts of the workflow that require interpretation, adaptation or decision-making.
3. Is Agentic AI different from AI?
Agentic AI is a type of AI application rather than a completely separate technology.
A typical AI system may respond to a prompt and return an answer. An agentic system can go further by deciding what should happen next and taking action across several steps or connected tools.
The main difference is therefore not simply what the AI knows, but how much it can do on your behalf.
4. Is ChatGPT agentic?
ChatGPT has agentic capabilities, although not every interaction with it is agentic.
For example, a standard question-and-answer exchange mainly involves generating a response. Agentic use involves working through a larger task that may require planning, using tools, accessing files or apps, and completing several steps towards an outcome.
5. Does every AI agent need a human in the loop?
Not at every stage. If the task is clear, low-risk, easy to verify and simple to reverse, asking for human approval after every action may add unnecessary delay.
Human involvement becomes more important when the agent is dealing with money, sensitive information, unclear situations or actions that are difficult to undo. The aim is to keep people involved where their judgement and accountability matter most.
6. What types of permissions should never be given to an AI agent by default?
Avoid giving an agent broad permissions simply because they might be useful later.
Access such as unrestricted payment authority, destructive database permissions, administrator-level controls, bulk external messaging or confidential information unrelated to the task should only be granted when there is a clear need and suitable safeguards are in place.
A safer starting point is to give the agent only the access required for its current task, then expand those permissions if the workflow genuinely calls for it.
7. How often should an Agentic AI workflow be reviewed?
There is no single review schedule that works for every workflow.
A low-risk internal research process may only need periodic checks, while an agent handling financial, customer or operational actions may need much closer monitoring. You should also review the workflow whenever you change its permissions, connected tools, policies, models or important business rules.
The more responsibility the agent has, the more important regular review becomes.
8. Can multiple AI agents supervise one another instead of using human approval?
Multiple agents can review, check or critique one another, and this can improve verification in some workflows.
However, this does not automatically remove the need for human oversight. Two agents may still rely on the same incorrect information, share similar blind spots or interpret an unclear instruction in the same way.
Agent-to-agent review can strengthen the process, but decisions with serious consequences may still need a person to approve the final action.
9. At what point should a business increase an AI agent's autonomy?
Increase autonomy only after the agent has shown that it can perform reliably within clearly defined limits.
Do not judge this only by how well it handles routine cases. Look at what happens when information is missing, instructions conflict, a tool fails or the situation falls outside the normal process.
A sensible progression is to start with AI assistance, move to actions that require approval, and only then allow limited autonomous actions once the agent has shown that it can handle the workflow consistently.
