Where Should AI Actually Have Decision Authority?

AI Strategy Series | Article 4 of 20

Building the Intelligent Enterprise

Artificial intelligence is moving beyond answering questions.

It is beginning to make things happen.

AI systems can evaluate transactions, initiate workflows, modify software, negotiate within defined parameters, allocate resources, interact with customers, and execute increasingly complex sequences of actions.

Agentic AI extends these capabilities by allowing systems to pursue objectives through multiple steps, selecting tools and taking actions with varying degrees of human intervention.

The technological implications are substantial.

The strategic implications are considerably greater.

For decades, enterprise technology primarily supported decisions made by people.

Applications collected information, enforced business rules, generated reports, and executed transactions according to established instructions.

Artificial intelligence increasingly challenges that division of responsibility.

An AI system may interpret information, recommend a course of action, determine which steps to take, and execute those steps through connected enterprise systems.

That progression introduces a question every enterprise AI strategy must eventually answer:

Where should artificial intelligence have decision authority, and where must that authority remain with human beings?

This is not simply a question about AI safety or regulatory compliance.

It is a fundamental enterprise strategy decision.

The authority assigned to AI determines how business processes can be redesigned, how quickly decisions can be made, which organizational capabilities become possible, and where accountability must remain anchored.

An organization that deploys AI without defining its decision authority is not merely introducing a new technology.

It is changing its operating model without fully specifying who—or what—is permitted to act.

The Difference Between Intelligence and Authority

One of the most important distinctions in enterprise AI strategy is the difference between a system’s ability to produce an intelligent output and its authorization to act on that output.

An AI system may be capable of evaluating a supplier’s performance.

That does not mean it should be authorized to terminate the supplier relationship.

It may identify a suspicious financial transaction.

That does not automatically justify freezing a customer’s account.

It may recommend changes to production software.

That does not mean it should deploy those changes without additional controls.

It may calculate an optimal inventory allocation.

That does not establish whether it should be allowed to override contractual commitments or customer priorities.

Capability and authority are different concepts.

AI capability determines what a system can do. Decision authority determines what the enterprise permits it to do.

This distinction is frequently obscured by discussions about AI autonomy.

An organization may describe an AI agent as autonomous because it can perform multiple tasks without continuous human direction.

But autonomy is not a single technical characteristic.

It involves several distinct dimensions.

A system may independently gather information while remaining prohibited from changing enterprise records.

Another may execute approved transactions but lack authority to alter the rules governing those transactions.

A third may recommend actions across several business functions but require explicit approval before committing organizational resources.

These systems possess different forms of operational independence.

Their strategic significance depends on the authority attached to those capabilities.

Four Levels of AI Decision Authority

For enterprise strategy purposes, I recommend distinguishing four levels of AI participation in business decisions.

These levels provide a practical framework for determining how AI should interact with enterprise processes.

They are not universal regulatory classifications. They are a strategic model for evaluating the relationship between intelligence, execution, and organizational authority.

Level 1: AI Informs

At the first level, AI provides information, analysis, interpretation, or synthesis.

Examples include:

• Summarizing customer interactions.
• Analyzing financial statements.
• Identifying operational anomalies.
• Retrieving relevant enterprise knowledge.
• Producing forecasts or scenario analyses.
• Highlighting inconsistencies in business records.

The system improves access to information and may reduce the effort required to understand complex situations.

However, it does not independently select or execute a business decision.

Human users remain responsible for interpreting the output and determining what action, if any, should follow.

This level is appropriate when AI can improve situational awareness but the enterprise has not established sufficient confidence or justification for delegating additional authority.

The primary strategic value comes from improving the speed, availability, and quality of information.

Level 2: AI Recommends

At the second level, AI evaluates alternatives and proposes a course of action.

Examples include:

• Recommending inventory replenishment quantities.
• Prioritizing customer service escalations.
• Suggesting credit risk classifications.
• Identifying maintenance interventions.
• Recommending staffing adjustments.
• Proposing changes to software architecture.

The distinction from Level 1 is important.

The system is no longer merely presenting information.

It is influencing a specific decision by selecting or ranking alternatives.

A human decision-maker retains authority to accept, reject, or modify the recommendation.

However, the human role must be meaningful.

If employees routinely approve AI recommendations without examining their basis, the organization may have created de facto automated decision-making while maintaining the appearance of human control.

A human approval step does not preserve meaningful human authority if the person approving the recommendation lacks the information, time, or practical ability to challenge it.

The strategic objective at this level is to improve decision quality and consistency while retaining human judgment over consequential choices.

Level 3: AI Executes Within Defined Authority

At the third level, AI can take action without obtaining individual human approval for every transaction.

Its authority is explicitly bounded.

For example, an AI system might:

• Reorder inventory within approved financial limits.
• Resolve routine customer requests under established policies.
• Adjust cloud infrastructure capacity within defined thresholds.
• Execute approved maintenance procedures.
• Route transactions according to established business criteria.
• Implement low-risk operational changes within authorized parameters.

The organization has delegated execution authority, but not unlimited discretion.

The system operates within defined constraints involving transaction values, permitted actions, system access, operational conditions, and escalation requirements.

This level offers substantial opportunities for process improvement.

It can reduce decision latency, eliminate repetitive approvals, and increase operational throughput.

But it also requires a more sophisticated enterprise architecture.

The organization must establish how authority is represented, enforced, monitored, and revoked.

The system must not merely be instructed to remain within its boundaries.

Those boundaries must be enforced through appropriate technical and operational controls.

Level 4: AI Makes Bounded Autonomous Decisions

At the fourth level, AI has authority to select among permitted actions and execute decisions in pursuit of defined objectives without requiring approval for each decision.

For example, an AI agent might coordinate logistics adjustments across multiple systems, dynamically allocate operational resources, or manage certain infrastructure conditions within established operating boundaries.

The system may determine which actions are necessary, sequence those actions, and respond to changing conditions.

This is a more consequential delegation of authority than executing predefined transactions.

The enterprise is authorizing the system to exercise discretion within a defined domain.

That does not mean the AI possesses unrestricted authority.

The organization must still define objectives, constraints, prohibited actions, escalation conditions, monitoring requirements, and termination mechanisms.

It must also determine which decisions remain exclusively human.

Autonomous execution does not require autonomous governance.

An AI system may independently select operational actions while remaining subject to human-established authority boundaries and organizational accountability.

That distinction will become increasingly important as agentic AI systems mature.

Decision Authority Is Not a Binary Choice

Enterprise discussions frequently reduce AI oversight to two alternatives.

Either a human remains in the loop, or the system operates autonomously.

That framing is too simplistic for complex organizations.

Consider an AI-enabled procurement process.

The system might independently identify suppliers, compare pricing, analyze delivery performance, and recommend purchasing decisions.

It might also be authorized to execute purchases below a specified threshold.

Transactions exceeding that threshold could require management approval.

Supplier changes involving contractual obligations might require legal review.

Purchases involving restricted materials could be prohibited entirely.

The system therefore operates under several different authority arrangements within the same business process.

Some activities are informational.

Others are advisory.

Some involve delegated execution.

Still others remain reserved for human decision-makers.

This is a more realistic model of enterprise AI than assigning a single autonomy classification to an entire application.

Decision authority should be defined at the level of the action and its consequences, not merely at the level of the AI system.

A single agent may be permitted to perform dozens of actions while remaining prohibited from executing a small number of consequential ones.

The enterprise must distinguish among them.

Five Factors That Should Determine AI Authority

How should leadership decide which decisions can be delegated?

The answer cannot depend solely on model accuracy or technical sophistication.

A highly capable AI system may still be inappropriate for certain decisions.

Conversely, relatively simple automation may be entirely appropriate for high-volume operational activities.

I recommend evaluating five factors.

1. Consequence of an Incorrect Decision

The first consideration is the potential impact of error.

An incorrect recommendation about internal document formatting has limited consequences.

An incorrect decision involving financial transactions, customer eligibility, production systems, safety-critical operations, or contractual commitments may have substantial consequences.

The enterprise should evaluate both the severity and plausible scope of adverse outcomes.

A low-value transaction executed once may be insignificant.

The same transaction executed incorrectly thousands of times could create material exposure.

Consequently, decision authority must account for cumulative effects, not merely individual transaction values.

2. Reversibility

Some decisions can be reversed easily.

Others cannot.

An AI system that incorrectly allocates a temporary computing resource may be able to restore the previous configuration.

An AI system that discloses confidential information, terminates a critical customer relationship, or executes an irreversible financial transaction presents a different problem.

The ability to reverse an action should influence the amount of authority delegated.

Where reversibility is limited, stronger approval requirements may be justified.

However, reversibility is not sufficient by itself.

A technically reversible action may still cause operational disruption, financial loss, or reputational damage before it is corrected.

3. Decision Complexity and Context

Some decisions involve well-defined objectives, reliable information, and measurable outcomes.

Others depend on ambiguous context, competing interests, organizational judgment, or incomplete information.

AI may perform effectively in structured operational environments where decision criteria are clear and outcomes can be evaluated.

Greater caution is appropriate when decisions involve conflicting objectives, ethical considerations, unusual circumstances, or consequences that are difficult to quantify.

This does not mean humans always make better decisions.

Human judgment is also subject to inconsistency, bias, fatigue, and incomplete information.

The strategic question is which combination of human and machine capabilities produces the most reliable decision process for the circumstances.

4. Observability and Intervention

Delegated authority becomes more consequential when the organization cannot readily observe or interrupt the resulting actions.

A system that executes one transaction and records its outcome presents a different operational challenge from an agent that performs hundreds of interconnected actions across multiple platforms.

Leadership should determine whether the enterprise can:

• Observe actions as they occur.
• Identify deviations from authorized behavior.
• Restrict or suspend activity.
• Revoke access or delegated permissions.
• Recover from incorrect actions.
• Reconstruct the sequence of decisions afterward.

These capabilities influence whether the enterprise can responsibly delegate execution authority.

An AI system that cannot be effectively constrained or interrupted may be unsuitable for certain operational responsibilities regardless of its apparent performance.

5. Strategic Value of Delegation

Finally, leadership must determine whether delegating authority creates meaningful business value.

Autonomy is not inherently desirable.

An organization may gain little by allowing AI to execute decisions that occur infrequently, require minimal human effort, or carry substantial consequences.

By contrast, bounded autonomy may be highly valuable in high-volume processes where decision latency limits operational throughput.

The enterprise should evaluate whether delegation improves capacity, speed, quality, consistency, resilience, or economic performance.

The appropriate level of authority is therefore a strategic choice.

It should reflect both the consequences of delegation and the business value it enables.

A Practical AI Decision Authority Matrix

These considerations can be translated into a practical decision framework.

Decision Characteristics	Appropriate Starting Position
Low consequence, easily reversible, well-defined criteria	Consider bounded automated execution
Moderate consequence, measurable outcomes, effective monitoring	Consider delegated execution with thresholds and escalation
High consequence, limited reversibility, significant uncertainty	Retain explicit human approval
Ambiguous objectives, competing stakeholder interests, substantial judgment	Use AI for analysis or recommendations
High-volume operational decisions with clear boundaries and intervention capability	Evaluate bounded autonomous decision-making
Actions involving prohibited conduct or authority the organization cannot delegate	Do not authorize AI execution

This matrix is a starting point, not a substitute for context-specific analysis.

Legal obligations, contractual requirements, industry standards, safety considerations, and organizational risk tolerance may require more restrictive arrangements.

The important principle is that authority should be deliberately assigned.

It should not emerge accidentally from the technical capabilities of a deployed system.

The Strategic Problem With Human-in-the-Loop Thinking

Human-in-the-loop oversight is frequently presented as a universal solution to AI decision risk.

But the phrase conceals several important questions.

Which human?

At what point in the process?

With what information?

Possessing what authority?

And with how much time to intervene?

Consider an AI system processing thousands of operational transactions each hour.

If a human must approve every transaction, the organization may eliminate much of the efficiency the system was intended to create.

Alternatively, if one employee is expected to review hundreds of recommendations under severe time pressure, the approval process may become little more than a procedural formality.

Neither arrangement necessarily produces effective oversight.

A more sophisticated approach assigns human involvement according to decision characteristics.

Routine actions within established boundaries may proceed automatically.

Unusual conditions may trigger additional review.

Transactions exceeding defined thresholds may require explicit approval.

Actions involving significant uncertainty may be suspended pending investigation.

Decisions involving strategic tradeoffs may remain entirely human.

This approach is sometimes described through concepts such as human-in-the-loop, human-on-the-loop, and human-in-command.

These terms can be useful, but the labels are less important than the operational reality.

Human oversight should be designed around actual decision authority and intervention capability, not the symbolic presence of a person somewhere in the workflow.

Authority Must Be Enforced by Architecture

There is a significant difference between telling an AI system what it is permitted to do and ensuring that it cannot exceed those permissions.

A prompt might instruct an AI agent not to approve purchases above $10,000.

That instruction does not constitute a sufficient authorization mechanism.

The enterprise application receiving the purchase request should independently enforce the transaction limit.

Similarly, an agent instructed not to access restricted information should operate through identity and access controls that prevent unauthorized retrieval.

A system prohibited from modifying production infrastructure should not possess unrestricted credentials capable of making those modifications.

This distinction becomes especially important as organizations deploy agents capable of invoking APIs, interacting with applications, and coordinating actions across systems.

Authority must be represented through enforceable controls.

These may include:

• Scoped identities and permissions.
• Transaction and expenditure limits.
• Approved action catalogs.
• Workflow approval requirements.
• Policy enforcement points.
• Environment restrictions.
• Rate and volume limits.
• Monitoring and anomaly detection.
• Emergency suspension and revocation mechanisms.

The architecture should also preserve sufficient information to reconstruct consequential actions.

That includes identifying the initiating objective, applicable authority, relevant system state, actions executed, and resulting outcomes.

The specific implementation will vary across platforms and use cases.

But the underlying principle is consistent.

An AI agent should not possess more operational authority than the enterprise has deliberately chosen to delegate.

And that delegation should be enforceable independently of the model’s own interpretation of its instructions.

Decision Authority Changes the Enterprise Operating Model

The strategic significance of AI authority extends beyond individual applications.

As AI systems assume greater responsibility for operational decisions, organizations may need to redesign how work is assigned, supervised, escalated, and evaluated.

Consider a traditional customer service operation.

Employees receive requests, retrieve information, evaluate circumstances, select responses, and execute authorized actions.

Supervisors manage exceptions and approve decisions outside established limits.

Now introduce AI agents capable of handling routine requests, retrieving account information, interpreting policies, and executing permitted transactions.

The organization may no longer need employees to perform every routine step.

Instead, human roles may increasingly concentrate on exceptions, relationship management, complex judgment, and oversight of automated processes.

That changes workforce requirements.

It changes supervisory responsibilities.

It changes performance measurement.

It changes how operational capacity is planned.

And it may change the architecture of the business process itself.

The enterprise is no longer simply adding an AI tool to an existing workflow.

It is redistributing work and decision authority among human and machine participants.

This is why agentic AI cannot be treated exclusively as a software deployment initiative.

Its strategic value depends on redesigning the operating model around the capabilities and boundaries of the technology.

Delegated Authority Creates a New Form of Enterprise Dependency

Traditional enterprise systems depend on infrastructure, software, data, and human operators.

Agentic systems introduce another dependency: the reliability of machine-directed action.

An organization that delegates operational authority to AI must consider what happens when the system becomes unavailable, produces inconsistent decisions, or must be suspended.

Can the business process continue?

Can humans resume responsibility?

Are the necessary procedures and expertise still available?

Can incomplete transactions be identified and reconciled?

Can the organization distinguish actions already completed from actions merely proposed?

These questions belong in enterprise strategy because they influence operational resilience.

A process redesigned around autonomous execution may achieve substantial efficiency gains.

But those gains can create new dependencies.

If the organization eliminates the human capacity required to operate the process manually, an AI system failure may become a business continuity event.

The strategic decision therefore involves more than whether autonomy is technically feasible.

It also involves determining the appropriate balance between efficiency, resilience, and organizational capability.

Delegating work to AI does not eliminate the enterprise’s responsibility to understand how that work is performed or how it can be recovered.

Who Owns the Decision When AI Acts?

Artificial intelligence does not become an independent corporate officer merely because it can execute decisions.

Organizations remain responsible for their business activities and must assign accountability through their established legal, management, and governance structures.

The precise legal consequences depend on the jurisdiction, industry, contractual relationships, and circumstances.

But the management principle is straightforward.

A decision executed by AI must remain attributable to an accountable organizational function.

That responsibility cannot be transferred to a model.

For example, an AI system may be authorized to approve routine procurement transactions.

The procurement function remains responsible for the process.

Technology leadership remains responsible for the relevant technical infrastructure and controls.

Risk, compliance, and legal functions may establish additional requirements.

Executive management remains responsible for ensuring that delegated authority is appropriate to the enterprise’s objectives and obligations.

This is not an argument for requiring executive approval of every AI action.

It is an argument for making authority explicit before automation changes how decisions occur.

An organization should be able to identify who authorized the delegation, which actions are permitted, what boundaries apply, and who can intervene when those boundaries are threatened.

The more consequential the authority, the more important those answers become.

The Boardroom Question Is Changing

Boards have spent considerable time asking management where artificial intelligence is being deployed.

That question remains useful.

But it is becoming insufficient.

Knowing that an enterprise uses AI in procurement, finance, customer service, software engineering, or operations does not reveal what those systems are permitted to do.

A customer service assistant that summarizes interactions presents a different strategic profile from an agent authorized to issue refunds, modify account terms, or terminate services.

A software development assistant that recommends code changes differs substantially from an agent authorized to deploy changes into production.

A financial analysis system that identifies anomalies is not equivalent to one permitted to suspend transactions.

The boardroom conversation must therefore move beyond deployment inventories.

Directors should ask:

• Where does AI currently influence decisions?
• Where does it execute decisions?
• What authority has management delegated, and on what basis?
• Which decisions remain reserved for human judgment?
• What prevents AI systems from exceeding their authority?
• Can management suspend delegated authority without disabling critical business operations?

These questions connect AI strategy to enterprise operating design.

They also help directors understand whether management is making deliberate decisions about autonomy or allowing technical implementation choices to determine organizational authority.

The distinction is essential.

The Executive Imperative

The next phase of enterprise AI will not be defined solely by increasingly capable models.

It will be defined by how organizations decide to use those capabilities.

AI that informs can improve situational awareness.

AI that recommends can improve decision quality.

AI that executes can reduce operational friction.

AI that makes bounded autonomous decisions can enable operating models that were previously impractical.

Each level creates opportunities.

Each also changes the relationship between technology, human judgment, and organizational responsibility.

Enterprise leaders should therefore establish a deliberate approach to assigning AI decision authority.

That approach should consider consequences, reversibility, decision complexity, observability, intervention capability, and strategic value.

It should distinguish informational assistance from operational execution.

It should ensure that delegated authority is technically enforceable.

And it should recognize that changing who—or what—makes decisions changes how the enterprise operates.

The objective is not to maximize AI autonomy.

Nor is it to preserve human involvement in every activity regardless of its value.

The objective is to establish the appropriate distribution of decision authority for the enterprise’s strategic objectives, operational requirements, and risk tolerance.

The most important question is not how much autonomy artificial intelligence can achieve. It is how much authority the enterprise should deliberately give it.

Because once AI begins acting on behalf of the organization, the architecture of intelligence becomes inseparable from the architecture of decisions.

And that is a strategic choice no enterprise should make accidentally.

References

International Organization for Standardization and International Electrotechnical Commission. ISO/IEC 42001:2023: Information Technology—Artificial Intelligence—Management System. Geneva: ISO, 2023. https://www.iso.org/standard/81230.html.

National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1. Gaithersburg, MD: U.S. Department of Commerce, January 2023. https://doi.org/10.6028/NIST.AI.100-1.

National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. NIST AI 600-1. Gaithersburg, MD: U.S. Department of Commerce, July 2024. https://doi.org/10.6028/NIST.AI.600-1.

Organisation for Economic Co-operation and Development. OECD AI Principles. Adopted 2019; updated May 2024. Paris: OECD. https://oecd.ai/en/ai-principles.

European Parliament and Council of the European Union. Regulation (EU) 2024/1689 of June 13, 2024, Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act). Official Journal of the European Union, July 12, 2024. https://eur-lex.europa.eu/eli/reg/2024/1689/oj.

Coming Next

Article 5 — Your AI Strategy Inherits Your Data Strategy

Enterprise leaders increasingly expect artificial intelligence to extract value from organizational information.

But AI does not eliminate the consequences of fragmented data, inconsistent definitions, unclear ownership, poor provenance, or inaccessible enterprise knowledge.

It can amplify them.

In the next article, we examine why AI strategy depends on the information architecture and data capabilities an organization has already established—and why deploying more sophisticated models cannot compensate for an enterprise that does not understand or control its own information.