If your IT services firm runs AI agents on client systems, write down for each one who owns it, what it may do without a person's approval, and what a wrong action would cost to reverse, then put an approval step in front of every action that is expensive to undo.
In an article MIT Sloan Management Review and BCG published in September 2026, 72 percent of a panel of 29 AI experts strongly agree or agree that governance that treats agents as autonomous decision makers will fail. The article's first recommendation is to decide what an agent may do alone based on the reversibility and real-world impact of each action, along with how accurately and reliably the agent performs it. On that second measure, Stanford's AI Index, published in April 2026, reports that on OSWorld, a test of computer tasks across operating systems, agent accuracy rose from roughly 12 percent to 66.3 percent, within 6 percentage points of human performance, though agents still fail roughly 1 in 3 attempts on structured benchmarks.
The list needs one line per agent with four entries. The owner is a named person who answers for what the agent does, and the MIT article advises assigning that ownership before deployment rather than after something has gone wrong. The cost to undo is what reversing a wrong action would take in hours and money, plus what cannot be reversed, such as client data exposed or money owed under a contract. The other two entries sort the agent's actions by that cost: those cheap to put right go under allowed alone, the rest go under approval required, each with the named person who approves it, and the owner decides where cheap ends.
The line for an AI agent on the service desk might read: owner, the service desk manager; allowed alone, routing tickets and restarting a stalled service; cost to undo, minutes of desk time for those two, and for anything more, an account in the wrong hands, a client outage, lost data or money paid back. Approval required lists resetting a password, changing a firewall rule on a client's network, deleting a user's mailbox and issuing a service credit. Each approval goes to a named person, such as the engineer assigned to that client for a firewall change or the account manager for a credit, and the agent waits.
Password resets need approval because attackers target them. A joint FBI and CISA advisory, last updated in July 2025, describes Scattered Spider, a criminal group that targets large companies and their contracted information technology (IT) help desks, posing as employees to get help desk staff to reset their passwords. For a reset, the approver first confirms the request with the employee's manager at the client, because the group also takes over targeted users' phone numbers through their mobile carriers.
Put the limit in the agent's permissions and the approval step in the workflow, so the agent cannot act before someone signs off. The article recommends building those limits into the system architecture itself instead of relying on a written policy or a prompt instruction.
Revisit every line at each quarterly review, and sooner when an agent gets a new tool, a new client or a new kind of task, since the article tells organizations to reassess those thresholds as the stakes of a task or goal change over time. For a PE-backed IT services firm, the approval records and the agent's action log show a buyer in diligence which actions on client systems a person approved and which the agent took alone.
