Record the person's decision as a binding fact on the case, then check every agent action against it at the moment of action. If the agent tries to do what the person ruled out, by any route, the action is refused and the verdict names the decision that stopped it. Reopening goes back to the person, never around them.
Why does an agent override a person at all?
Rarely out of defiance. It never saw the decision, or saw it as one input among many. A reviewer declines a refund in a ticket comment; the agent reads the customer's next message, finds the policy satisfied, and drafts the refund again.
The second cause is a side door: the same outcome reached another way, such as a goodwill credit instead of a refund, or a handover to an agent with wider bounds. A prompt does not close side doors. A check at the point of action does.
What are the steps, and who does each one?
- Process owner: lists the decisions people own. Declines, holds, pauses, exceptions, and anything a person decided after review. Evidence: a short decision register for the process.
- Process owner and platform team: record each decision as a signed fact. The record carries the case, the person's name, the time, the outcome and the reason, and it attaches to the customer or case, not to a conversation. Evidence: the decision record itself.
- Platform: treat the decision as a bound. Before any action on that case, the agent's proposed action is checked against recorded decisions. A conflict produces a refused verdict that names the decision. Evidence: the refused verdict in the append-only record.
- Process owner: close the side doors. Map each decision to every capability that could reach the same outcome, and bind them all. Evidence: the mapping, and refusals that show it working.
- Agent, depth 2: asks rather than acts. If new facts arrive, the agent drafts a request to reopen, addressed to the person who decided or their named cover. Evidence: the held request and the answer.
- Team lead: reviews refused attempts weekly. Repeated attempts on the same case usually mean the agent's brief is wrong, not the person. Evidence: the review note and any brief change.
The principle behind steps 3 and 4 is set out in why every agent decision needs a named bound: if a verdict cannot say which bound decided, nobody can show the person's decision was respected.
What may the agent still do once a person has decided?
| After a person decides | The agent may | Stays with the person |
|---|---|---|
| A refund is declined | Explain the decision to the customer using the recorded reason | Changing the outcome |
| A payment is held | Gather the documents the person asked for | Releasing the payment |
| Contact with a customer is paused | Log inbound messages and route them | Lifting the pause early |
| An exception is refused | Draft a reopen request with new evidence | Deciding the reopen |
The agent keeps working the case. It loses only the ability to reach a different answer alone.
What does this look like on a real case?
Take a lender's collections team. A collections officer agrees a 30-day pause in contact for a customer who reports a bereavement, and records it with a reason. On day 10 the agent's routine schedule would send a payment reminder.
The reminder is refused, and the verdict names the officer's pause as the deciding bound. On day 12 the customer emails about a repayment plan. The agent does not resume contact; it drafts a note to the officer with the message attached, asking whether to lift the pause. The officer's reply becomes a new decision record.
When the customer later asks why they received no reminder, the agent can give a plain answer. How to phrase that for the customer is covered in how to explain an AI agent's decision to a customer.
Which controls make it hold?
- Decisions live on the case, not in chat. A comment buried in a thread is not a bound. A structured record is.
- One check point for every route. Every capability that could reach the outcome passes the same check, including handovers to other agents.
- Expiry is explicit. A 30-day pause ends on a date. An open-ended hold stays until a person lifts it.
- Only the decider or named cover can reopen. The agent cannot pick a more lenient person.
- No unregistered agents. An agent outside your platform will not see the record at all, which is why stopping shadow AI agents is part of this control.
Where Pryme fits
In Pryme, a person's decision arrives through the Pryme Context Protocol as a signed fact: a named person answers for it. It joins the minimum chain as part of the customer's own limits, so a conflicting action is refused and the verdict names the decision. Every verdict is filed, which lets you reconstruct the decision from the record later. More on bounds is in our guide to agent governance.
Questions people ask
What if the person's decision was wrong?
Then a person corrects it. The agent can surface the evidence that suggests an error and hold a reopen request, but the correction is a new human decision with its own record.
Does this slow the agent down?
Very little. The check runs on actions, not reading or drafting, and most cases carry no conflicting decision.
What about decisions made by a person outside the team?
They count if they are recorded on the case with a name. A verbal instruction from a manager is not a bound until someone records it, which is also what makes it auditable rather than merely logged.