AI agents
Agentic AI in the Enterprise: Where the Approval Boundary Belongs
The question that decides whether an agent is deployable is not how capable it is. It is which actions require a named human first, and why that line sits where it does.
The approval boundary should follow reversibility and audience, not model confidence. Actions that stay inside your boundary and can be undone are reasonable to automate. Actions that leave the organisation or cannot be undone should require a named human, because the downside is not symmetric with the time saved.
- Draw the line by reversibility and audience, never by model confidence.
- A confidence score is a property of the model, not of the consequence.
- Agents that always act are easy to build. Agents that know when to wait are the useful ones.
Why confidence is the wrong axis
The intuitive design is to let the agent act when it is confident and ask when it is not. It is intuitive and it is wrong, for two reasons.
First, confidence is a property of the model's internal state, not of what happens if it is wrong. A system can be entirely confident and entirely wrong, and the cost of that wrongness is set by the action, not by the certainty.
Second, it makes the boundary unpredictable. Nobody can state in advance what the agent will do, which means nobody can approve the deployment, and security review will stop it. "It asks when unsure" is not a control an assessor can test.
Two axes that work
Reversibility
Can this be undone, and how quickly? Scaling a service is reversible in minutes. A sent email is not reversible at all. Reversibility is objective and testable, which makes it a usable control.
Audience
Does this stay inside the organisation? An internal annotation has a small blast radius. A message to a vendor or a customer is a commercial act carrying your name, and it is a relationship you continue to hold afterwards.
Reversible and internal: automate freely. Reversible but external: draft, require approval. Irreversible but internal: require approval. Irreversible and external: require approval, and record who gave it. No confidence score anywhere in that table, which is the point.
What this means in practice
Applied to integration operations:
- Automate: reading signals, correlating them, assembling a timeline, matching a recurrence, computing scope, writing a draft. All internal, all reversible, all high volume.
- Require approval: anything sent to a vendor or customer, any configuration change, closing an incident, changing severity in a system others rely on.
- Never: widening the agent's own permissions. An agent that can expand its own scope has no boundary at all, whatever the configuration claims.
Approval has to be cheap or it gets removed
A boundary that makes approval burdensome gets dismantled within a quarter, and then you have an unbounded agent and a policy document that is now fiction.
Cheap approval means: it arrives where the approver already is, usually email; the evidence comes with it so no tool-switching is required; approving is one action; and declining is equally easy and is recorded. If approving takes more effort than doing the task manually, the design has failed regardless of intent.
Why this is also the commercial answer
Security review is the last gate before signature on most enterprise deals and the slowest to clear. "Every outbound action requires a named approver, and the decision is recorded" is a statement an assessor can test. "The model asks when it is unsure" is not.
So the restrictive design is frequently the faster one to deploy, which is counterintuitive until you have sat through the review. It is the reason Traxivo is built this way rather than as a demonstration of autonomy, and it is what makes the approval trail a by-product rather than a project.
A test before you deploy anything
Ask the vendor to state, in one sentence, what their agent can do without a human. If the answer needs qualifiers, conditions or a confidence threshold to explain, the boundary is not a boundary. It is a hope.
Frequently asked questions
Where should the approval boundary sit for an AI agent?
Along reversibility and audience. Reversible internal actions can be automated; anything that leaves the organisation or cannot be undone should require a named human whose decision is recorded. Model confidence is not a usable axis because it describes the model rather than the consequence.
Why not let the agent act when it is confident?
Confidence is unrelated to the cost of being wrong, and it makes behaviour unpredictable. Nobody can state in advance what the agent will do, which means nobody can approve the deployment and security review will block it.
Does requiring approval remove the value?
No, provided approval is cheap. Most of the value is in correlation, recurrence detection and evidence assembly, which all happen before the boundary. Approval costs seconds when the evidence arrives with the request.
Stop rediscovering the same integration failure
Traxivo correlates the signals your tools already produce into one incident timeline, recognises a recurrence as a recurrence, and drafts the follow-up with the evidence attached. Nothing is sent without a named approver.
See how Traxivo works Browse use cases
