Two decisions happen, by two different parts. The model proposes the next step, choosing from the tools it has been given based on its goal, the facts in front of it and the results so far. The governing layer then decides whether that step may happen. Treating the model's choice as the final word is where most agent risk begins.
How does the model choose a next step?
At each turn, the model reads its context: the brief that says what the agent is for, the task, the facts gathered so far, the descriptions of the tools available, and the results of earlier steps. It produces either an answer or a request to use a tool with particular inputs.
That choice is shaped by everything in the context. A clear brief and distinct tools produce sensible choices. Ambiguous tools, missing facts or instructions hidden in a customer's email produce poor ones. The model is predicting a useful next step, not consulting a rulebook, so the same situation can produce slightly different choices on different runs.
Why should the model not have the final say?
Because its choice can be steered. Text in an input can suggest an action. A gap in the facts can be filled with a plausible guess. A goal like "resolve the complaint" can be pursued by the quickest route rather than the right one. None of this is malicious; it is how prediction works.
So the proposal goes to the platform, which checks it against the agent's bounds: its role, its certificate and depth for that capability, the facts' sources, your limits and the platform guardrails. The question of who sets those bounds is a business one, covered in who should decide what an AI agent is allowed to do.
Which next steps may an agent take on its own?
| Kind of next step | Agent decides | Platform or person decides |
|---|---|---|
| Which record to read next | Yes, within its data scope | Scope is set by people; see which data an agent may see |
| Which draft to prepare | Yes | None |
| Whether to perform a routine action | Proposes | Platform checks depth and limits |
| Whether to perform an irreversible action | Proposes | A person, unless certified at depth 4 |
| Whether to make a decision with legal or similar effect on a person | Drafts a recommendation | A person |
| Whether to stop and ask | Yes, and should | None |
The fifth row reflects GDPR Article 22, which restricts decisions based solely on automated processing that have legal or similarly significant effects on people. A design where the agent drafts and a person decides is covered in GDPR Article 22 and agents that draft but do not decide. Which actions can go without a person at all is a separate design exercise, set out in how to decide which actions an AI agent may take without a person.
What does this look like in practice?
Take a bank's onboarding agent reviewing a new business customer. It has read the application and the company register. Its next step options include requesting more documents, running a screening check, drafting a risk summary or setting the customer's risk rating.
The model proposes setting the rating to low, because the facts look clean. The platform checks: the agent's role allows it to draft ratings, not set them, because rating decisions in this bank belong to an analyst. The verdict is held, and the analyst sees the draft rating with its reasoning and sources. The question of whether an agent should ever set ratings is explored in whether an AI agent can decide a customer's risk rating.
The model then proposes its next step, drafting the summary, which is allowed.
What makes next-step decisions safer?
- A brief that states what the agent is for and when to stop.
- Tools that map to distinct business actions.
- Facts that arrive with their sources, so weak ones are visible.
- A rule that missing information produces a question, not a guess, tested during certification.
- Every proposal checked by the platform before it runs, and every verdict filed.
The layer that makes the second decision is described in the governed agentic operating system guide.
Questions people ask
Does the agent follow a fixed plan?
Sometimes it drafts a plan first, but it decides each step as it goes, in light of the latest results. That flexibility is useful and is why each step needs its own check.
Can you make the agent's choices fully predictable?
Not fully. You can make them consistent enough by narrowing tools, sharpening the brief and certifying on real cases. Predictability of outcomes comes from the bounds, not the model.
What if the agent keeps proposing actions that are refused?
That is a signal. Either its brief encourages steps outside its role, or its inputs are steering it. Review the pattern in the record and fix the cause rather than widening its bounds.