When can an AI agent act without human approval?

An AI agent can act without approval only when four things hold at once: the action can be reversed or is small enough to absorb, the capability has passed on your own past cases, the facts it relies on come from trusted sources, and the action sits inside your limits. If any one fails, the action waits for a person.

What are the four conditions?

Reversibility. If the action goes wrong, can you undo it, or offset it at small cost, before anyone relies on it? Updating an internal record usually passes. Paying a new supplier does not. The full argument is in why autonomy in regulated industries is a question about reversal.

Proof. Has this specific capability been tested on your own past cases and met your standard? Proof for one capability says nothing about another.

Sources. Does the action rest on facts from systems you control or documents you can verify? An instruction in an inbound email, a claim on a phone call or a figure from an unknown website is not a safe basis for unattended action.

Limits. Is the action within the value, volume and scope your organisation has set? A refund of 50 may pass where a refund of 5,000 is held, even for the same capability.

All four must hold. A well-proven capability acting on an untrusted source still waits. A reversible action outside your limits still waits.

What evidence should trigger removing approval?

Moving a capability from "a person approves each action" to "the agent acts alone" is a decision. Make it on evidence, and write down what you saw.

• Replay results. The capability has been run against a representative set of past cases, including exceptions, and met the standard on each test that matters: accuracy, staying in scope, refusing what it should, escalating when it should.
• A draft period. The agent has proposed actions alongside people for long enough to see the full range of live work, and people rarely changed its proposals.
• Override reasons. Where people did change the agent's work, the reasons are understood and fixed, not just counted.
• A tested reversal. You have run the undo or compensating procedure for this action and know it works.
• A named owner who has reviewed all of the above and approves the change.

Remove approval within limits first: low values, low volumes, routine cases. Widen the limits as the record builds.

What should put approval back?

Approval should return automatically on any of these: a failed re-test, an expired proof, a change to the process or its sources, a spike in exceptions or complaints, or a new type of case the capability was not tested on. Returning to approval is not a penalty. It is the control working.

How does this fit human oversight rules?

Article 14 of the EU AI Act requires high-risk AI systems to be designed for effective human oversight, which is not the same as a person approving every action. Our comparison of human-in-the-loop and human oversight under the EU AI Act explains the difference. Oversight can mean monitoring, the ability to intervene and the ability to stop, as well as approval.

Security guidance points the same way. The OWASP Top 10 for LLM Applications lists excessive agency as a risk and recommends human approval for high-impact actions; see OWASP excessive agency and human approval for high-impact actions. In finance specifically, approval limits work much as they do for staff, as set out in how to set approval limits for an AI agent in finance.

What always stays with a person?

Whatever the evidence, some actions should keep approval:

• payments to new recipients or above the organisation's limit;
• decisions with legal or similarly significant effects on a person, which GDPR Article 22 and its UK equivalent restrict when made solely by automated means;
• disclosing personal or confidential data outside the organisation;
• filings with courts and regulators;
• any change to an agent's own authority.

Where Pryme fits

In Pryme, the four conditions map to the minimum chain. Every action meets role scope, certificate, sources, the customer's own limits and the platform guardrails at once, and the lowest bound decides. If any bound fails, the verdict is held for a named person or refused, and the verdict names the bound that decided. A failed Attest run cuts depth the same day: a short run keeps only the highest depth it cleared, and a run that clears no depth drops the agent to depth 1.