AI Agents in Commerce Need Decision Rights, Not Just Guardrails

When Perfect Execution Isn't Enough

An AI agent can follow its instructions perfectly and still take an action the business never sanctioned. In commerce environments, this pattern is emerging in practical and costly ways. A service workflow calculates the correct refund amount but lacks a boundary preventing credits above what the business approved for autonomous action. An order agent correctly applies a requested change but overlooks a financing or fulfillment condition. A procurement agent identifies the lowest-cost supplier, but nobody has defined whether it can accept contractual terms or only recommend the option.

The agent keeps working. The problem may not surface until something downstream breaks. These are not AI reasoning failures — they are failures to separate technical capability from business authority. As enterprises move from copilots that recommend to agents that call tools and trigger workflows, every production agent needs explicit decision rights: what it may execute, what requires approval, what it may only recommend, and what it must never touch.

Guardrails remain necessary. But a guardrail is not an authority model.

The Governance Gap Is Becoming Harder to Ignore

In April 2026, a Cloud Security Alliance survey found that 65% of respondents had experienced an AI-agent-related incident in the prior year, while 82% had discovered previously unknown agents operating in their environments. The survey involved 418 IT and security professionals.

The findings illustrate how quickly agent activity can outpace the visibility and ownership structures built for conventional software. The World Economic Forum's May 2026 playbook introduced an Agent Capability and Authorization Profile designed to make delegated actions auditable, enforceable, and accountable. Singapore's updated Model AI Governance Framework for Agentic AI treats access controls, behavioral guardrails, and human approvals as separate controls, tying oversight requirements to action scope, reversibility, and potential impact.

Safety Controls and Decision Rights Solve Different Problems

Early generative AI controls screen harmful content, protect sensitive information, validate responses, and constrain tool behavior. That work matters. Decision rights answer a different question: Even when an action is safe and technically valid, is this agent authorized to take it on behalf of the enterprise?

In commerce, the distinction is critical. A refund may be mathematically accurate and content-safe — but exceed the dollar threshold the business approved for autonomous agent action. An order change may match the customer's request perfectly but invalidate a financing condition. A delivery promise may reflect available inventory while overlooking a carrier constraint applied an hour earlier. The agent may not have failed to reason. The enterprise failed to define where its authority stopped.

The Agent Authority Contract

Before an agent receives access to enterprise tools, it needs a machine-enforceable record of exactly what authority the business has chosen to delegate. This "Agent Authority Contract" should answer at minimum seven questions:

1. Who owns the outcome? Name a human or business role, not another system.
2. What may the agent do? Read, recommend, write, or commit?
3. Which systems and data may it reach?
4. What materiality limits apply? Define dollar thresholds, record counts, customer scope, and operational impact.
5. What triggers escalation? Uncertainty, anomaly, sensitive data, or potential impact?
6. Can the action be reversed, and who can reverse it?
7. When does the authority expire, and how is it withdrawn?

Access control determines whether an agent can reach a system. The authority contract determines whether it may take a specific action in the current context. Those are not the same check.

Four Outcomes for Every Consequential Action

A working decision-rights model should map every consequential agent action to one of four results:

• Allow: Low-risk, bounded, and reversible actions run autonomously — retrieving approved information, classifying an inbound request, or updating a non-material field.
• Approve: The agent prepares the action, but execution waits for authorization from a human or deterministic policy service — covering payments, production changes, and actions that materially affect a customer.
• Recommend: The agent analyzes, ranks, drafts, or proposes. A named human makes the final decision — used when contextual judgment matters or when the financial or individual impact makes automated execution unacceptable.
• Deny: The action remains outside the agent's authority regardless of its confidence — deleting critical production data, making final employment decisions, or overriding mandatory compliance controls. Deny must be enforced outside the system prompt; a natural-language instruction is not a technical boundary.

Make Authority Decisions at Runtime

Static configuration cannot cover every situation. A small service credit might be allowed under normal conditions but require approval when the amount crosses a threshold, the account is under investigation, or the request involves a regulated customer. A practical runtime sequence evaluates the agent's identity, the requested tool, the data involved, the transaction context, and the potential impact — then returns Allow, Approve, Recommend, or Deny.

Requiring human approval for every agent action looks conservative but quickly degrades into rubber-stamping at scale. When reviewers approve thousands of routine actions, attention declines and genuine exceptions become harder to identify. Proportional authorization is the more workable model: low-risk actions run within narrow boundaries, high-risk actions require approval, unexpected behavior triggers escalation, and any consequential action without a defined authorization policy is denied by default.

Measure Whether Authority Is Calibrated

Once agents are in production, response accuracy becomes too narrow a success metric. Enterprises should also track:

• Override rate: How often do humans reject or materially change what the agent decided?
• Escalation precision: Does the agent surface genuinely risky cases, or return routine work to people?
• Unauthorized-action attempts: How often does the agent try to exceed its system, data, or action scope?
• Business-impacting error rate: How often do authorized actions produce financial, compliance, or customer harm?
• Decision latency: Are approval requirements managing risk, or slowing down automation that was already safe?

Consistently reliable performance may justify expanding bounded authority. Frequent overrides, escalation failures, or policy violations should narrow it. The objective is not maximum autonomy — it is the highest level of autonomy the enterprise can observe, govern, and reverse responsibly.

What This Means for Commerce

The governance gap is not in the model. Model safety, output controls, and secure tool use all matter. But none of those controls answer who delegated authority, how much was transferred, under what conditions it applies, or who owns the result when something goes wrong. For commerce brands deploying AI agents — whether for customer service, order management, or procurement — building explicit authority frameworks now is essential before the volume of autonomous agent actions outpaces the ability to govern them.