Who approves what your AI just did?

The three questions every AI-assisted decision has to survive

An agent reprioritises a backlog. A generated summary reaches an executive. A risk assessment moves a release date. Six weeks later, somebody asks how that happened.

In most deployments the honest answer is a shrug. The chat session is gone. The prompt was never recorded. The action left a trail indistinguishable from a human one. And the approval, if there was an approval, lives in somebody’s memory.

An AI action you cannot reconstruct is not automation. It is an unattributed change.

That is the gap between an AI pilot and AI at work. A pilot has to be impressive. AI at work has to be accountable — to a regulator, an auditor, a customer, or simply to the person whose name is on the release.

Proposal-only is a design decision, not a limitation

The safest boundary is also the simplest one to explain: agents prepare, humans commit.

In practice that means an explicit list of things no agent does, regardless of how confident it is:

• No source writes — nothing reaches a repository without a person putting it there
• No ticket changes — status, scope and assignment stay human decisions
• No credential access — an agent never holds what a person would need a password for
• No pull requests and no deployments — the two places where a mistake becomes production

What remains is substantial. The agent assembles the evidence, drafts the option, names the trade-off it is making, and puts a decision in front of the person who owns it. The work moves. The authority does not.

This is a narrower claim than most AI tooling makes, and it is deliberate. A system that can act unilaterally has to be trusted unilaterally. A system that can only propose has to be useful — which is a much easier bar to verify.

Sixteen agents, eight personas, one approval boundary

Governance gets harder, not easier, when every team quietly adopts its own assistant. Sixteen tools with sixteen policies is not sixteen times the productivity; it is sixteen surfaces nobody is watching.

The alternative is one boundary and many agents inside it, each shaped to a role:

• Product owner agent — prepares value-driven backlog priorities, user stories and acceptance criteria, for product-owner review
• Scrum master agent — prepares ceremonies, impediment follow-ups and retrospective actions, without changing sprint commitments
• Capacity planner agent — prepares availability, workload and skill-gap scenarios; allocation changes remain a manager decision
• Risk agent — prepares evidence-backed risk assessments, mitigation options and escalation triggers, for owner review
• Quality agent — prepares test strategy, quality checks and release readiness evidence, for review
• Support agent — prepares first-response triage and a clear escalation handoff, without changing accounts or systems

Read those descriptions again and notice how each one ends. Prepared. For review. Without changing. The governance model is not a policy document filed somewhere — it is the product surface, stated in the same sentence as the capability.

What “evidence-backed” has to mean

“Evidence-backed” is close to meaningless as a marketing claim. It is precise as an engineering requirement, and the test is whether a decision can be reconstructed months later by someone who was not there.

That requires four things to survive:

• Which inputs the agent read, at which version
• Which rule, threshold or signal produced the recommendation
• What it did not consider, and why that was out of scope
• Who approved it, when, and what they were shown at the time

The last one is the one most systems lose. An approval recorded without the evidence the approver saw is a signature on a blank page. If the underlying data has since changed — and it always has — the record no longer explains the decision.

A cockpit, not a chat window

Governance you cannot see is governance you cannot claim. The administration surface should answer, at a glance, what is running and what it is allowed to do: how many agents are active, how many personas they serve, what proportion of them are in proposal mode, and how many actions have gone through unapproved.

That last figure is the only one on the panel that should never move. Active agents will grow. Personas will change as the organisation does. Proposal mode is a policy choice you can loosen deliberately, with a named owner. Unapproved actions at zero is the property that makes the other three safe to expand.

It is also the number an auditor will ask for first, and the one a chat-based assistant fundamentally cannot produce, because it never had a boundary to report against.

Governance that does not slow the work down

The objection is always the same: approvals will make everything slower.

They make the wrong things slower. Approving a drafted decision that arrives with its evidence attached is faster than assembling that evidence yourself, which is what the alternative actually looks like. The cost is not the click. The cost was always the gathering, and that is the part the agent absorbs.

What genuinely slows down is the unbounded action — the one that has to be reviewed after the fact, traced through three tools, and explained to somebody who is now unhappy. Preventing that is not friction. It is the difference between AI you can defend in a board meeting and AI you have to apologise for.