A comment on my last article ( https://www.imadlodhi.com/article/agentic-operations-needs-management-systems-that-work) made me think about something we probably need to talk about much more seriously as Agentic Operations evolves.

We have spent a lot of time discussing what agents can do.

Maybe we need to spend more time defining when they should stop.

In the first article in this series, I talked about giving the Major Incident Manager an intelligent operating team. In the second, I argued that those agents still need strong management systems underneath them.

But there is another layer inside that conversation: decision authority.

Humans have been compensating for ambiguity in management systems for decades. Agents will force us to remove it.

Experienced people do this constantly.

A seasoned Incident Manager knows when something needs to be escalated even if the process does not describe the exact situation. A senior engineer knows when the evidence is strong enough to recommend rollback. A Service Delivery Manager knows when an issue has moved beyond normal operations and somebody with greater authority needs to make the call.

Sometimes that knowledge is documented.

A surprising amount of the time, it isn't.

Experience can disguise a broken management system

This is something I discuss in the Roles & Responsibilities system of the First-Line Management framework.

An experienced employee can make an unclear operating model look much healthier than it really is.

They know who to call. They know which approvals actually matter. They know where responsibility really sits. They know when the documented process can be followed and when somebody needs to intervene.

Then that person leaves.

Suddenly the replacement has the job description, the process documentation and the tools—but cannot determine what decisions they are actually authorized to make.

The organization was depending on institutional memory living inside a person.

Now introduce an autonomous agent into that environment.

The agent cannot safely rely on organizational folklore.

From responsibility to decision authority

Roles & Responsibilities has always been about more than assigning tasks.

A useful role definition needs to answer questions such as:

Who owns the outcome?

What decisions can the role make independently?

Where does its authority stop?

When must it escalate?

Which other roles depend on its outputs?

Those questions become even more important when the role is partly being performed by an agent.

Because there is a significant difference between an agent observing something, recommending something and actually doing something.

Observe → Recommend → Act → Escalate → Stop

I think this gives us a practical way to think about agent authority.

Observe. The agent can detect and analyze. During a major incident, that might mean correlating monitoring alerts, service dependencies, recent changes and previous incidents.

Recommend. The agent can propose an action. It might conclude that a particular deployment strongly correlates with the outage and recommend rollback.

Act. The agent can execute within explicitly delegated authority. Perhaps it can run an approved diagnostic, restart a non-critical component or execute a pre-authorized recovery runbook.

Escalate. The agent recognizes that the decision exceeds its authority and routes it to the appropriate human decision-maker.

Stop. The agent refuses further autonomous execution because evidence is insufficient, authority is unclear, conditions conflict or the potential consequence exceeds an established risk boundary.

That last one matters enormously.

The most important instruction we give an autonomous agent may not be what it is allowed to do. It may be knowing when it no longer has the authority to decide.

Think about a major incident

Imagine a production service is down.

The agent has correlated the outage with a change deployed twenty minutes earlier.

Should it recommend rollback?

Probably.

Should it execute the rollback?

Maybe.

What if rollback could corrupt transactions?

What if another dependent service has already changed its data structure?

What if the rollback itself creates regulatory or customer risk?

What if two authorized humans disagree?

Now we are no longer talking primarily about technical capability.

We are talking about authority, evidence, consequence and accountability.

Those boundaries need to exist before the incident happens.

This is not an eighth management system

I would not add Decision Authority as an eighth First-Line Management system.

I see it as a design property running through several of the existing systems.

Roles & Responsibilities defines who owns the outcome, what decisions can be made and where authority ends.

Processes & Procedures defines the conditions under which decisions and escalations occur.

Technology & Tools enforces permissions, access rights, approvals and automation boundaries.

Meetings and governance provide the environment for consequential decisions that require human coordination.

Reporting, Measurements and Analytics provide the evidence used to make those decisions.

Once again, the systems are connected.

An unclear authority boundary does not stay a documentation problem. It becomes a delayed decision, an inappropriate action or an escalation that happens too late.

The question organizations should start asking

As organizations move from AI assistants toward agents that can execute operational work, I think every consequential action deserves a simple authority test:

What can the agent observe?

What can it recommend?

What can it execute?

When must it escalate?

When must it stop?

And behind every escalation there needs to be another answer:

Who is the human that actually has authority to decide?

If we cannot answer that clearly, the problem is not the agent.

The agent has simply exposed an ambiguity that was already sitting inside the management system.

Agentic Operations will not eliminate the need for human accountability. It will force us to become much clearer about where that accountability begins.

And I suspect that clarity may become one of the most important prerequisites for safe, scalable Agentic Operations.