Two Harvard economists tracked engineering teams at hundreds of companies as they adopted AI coding tools. The teams wrote more code. Reviews got slower. Finished work did not measurably rise.
It is not only code. Workday asked employees who use AI at large companies where the time it saved went, and much of it went straight back into rework: fixing errors, rewriting, checking.
I hit the same wall
I run most of my own work through AI agents, software that takes actions on its own instead of only answering questions. Mine file my notes, track what I have promised people, draft my email, and prepare me for calls.
When I first counted what was waiting on me, my agents had prepared 141 items that needed my yes. The oldest had waited a month. Separately, 86 of my 138 open tasks were an agent's draft I still had to finish. At about ten minutes each, by my estimate, that is around fourteen hours of review.
More agents would have meant more of it, because everything they produced landed on my desk.
So I stopped asking how to review faster. I started asking which actions needed me at all.
The question every agent raises
At its October symposium, Gartner repeated a prediction it first made two years ago: AI agents misused through machine access nobody manages will be behind a growing share of enterprise security breaches.
For any leader, the question becomes: what are our AI systems allowed to do without a person, and who decided?
Sooner or later a board, an auditor, or the public asks. The answer has to be in writing.
Two questions per action
I sort every action an agent can take with two questions:
- Can it be undone in one step?
- Whose judgment is it?
That gives three levels: Do it, Do it and tell me, and Ask first. The same two questions work for an agent that updates a customer record or issues a refund. This is the page I run:
| Action | Level | Why |
|---|---|---|
| File a meeting summary in internal notes | Do it | One step undoes it, and nobody outside sees it |
| Add a commitment someone made on a call to the task list | Do it | The words and the date came from the call |
| Add a commitment with no clear date | Do it | It files with no date. Picking a deadline is a person's call |
| Update a contact's notes after a call | Do it | Internal and reversible |
| Draft an email to a client | Do it and tell me | A draft is not a send, but someone should know it is waiting |
| Send an email, post, or publish | Ask first | It reaches another person and cannot be taken back |
| Spend money, any amount | Ask first | Spending is never delegated |
| Change a record a client or colleague sees | Ask first | Someone acts on it the moment it changes |
| Change a deadline, priority, or owner | Ask first | Priority is a judgment call |
| Anything not on this list | Ask first | Unclassified means no |
Strixo, 2026. strixo.ai/insights/who-signs-off-when-ai-acts
Three rules hold it together.
The level comes from the action. How confident the agent sounds changes nothing. A confident agent that sends the wrong email has still sent it.
Anything nobody has classified starts at Ask first. New tools and new kinds of action get more room only after they have earned it.
Every action goes into a log with the instructions to reverse it. That log now holds close to 1,900 actions, and the only program allowed to write to it refuses an entry without an undo. When the honest answer is "nothing to undo," the entry has to say so.
What changed
In one evening under the new rules, the pile waiting on me went from 141 items to 35. The items the agents were sure of filed themselves. The ones they were unsure of filed with no date, so nobody invented a deadline. What remained included the decisions that should have needed me all along.
What reaches me now is the work that needs my judgment.
The page is half of it
Before letting teammates use one of my agents, I checked what it could actually reach, instead of what my page said it could do. It could see far more files and systems than its job needed. Its changes could have gone live without review. And anyone in our shared workspace could pretend to be it.
My page said it could do none of that. Nothing stopped it.
A permission page says what an agent may do. Guardrails make sure that is all it can do. We closed every gap we found before opening it to the team.
A regulator and an analyst firm already agree
Singapore's framework for AI agents names reversibility, the scope of an agent's actions, and its level of autonomy among the factors that set risk. It lists irreversible actions, such as permanently deleting data, sending communications, and making payments, among the checkpoints that should need human approval. At the same Gartner event, analyst Svetlana Sicular put it in one line: "Tailor oversight to your level of autonomy."
Most organizations have not written theirs. Deloitte's latest enterprise survey found that only a minority have a mature way to govern AI agents, and its definition of mature includes clear lines on what an agent decides alone and what needs approval.
Build yours this week
- List every action your AI tools take, or will take. Twenty lines is a good start.
- Ask the two questions of each one.
- Anything that reaches a customer, spends money, or cannot be undone needs a person's approval first.
- Anything you have not classified needs approval too.
- For everything the AI does on its own, write down how to reverse it.
- Look again in a month. Give an action more room only when its record earns it.
It fits on one page, and an executive can sign it.
That page is where we start with every client.
What is the first action you would let AI take without asking you?