Puglisi Consulting for Artificial Intelligence

Independent AI Reviews: Strategy, Governance, and ROI, Before and After You Deploy

Workflow and AI Deployment: An Agent Action Should Earn Autonomy Through Its Approval Record #AIg

by

Komodor 2026 Agentic Operations Survey report cover: 1,000 engineering leaders on fleets, spend, and how much autonomy agents already have
Image: Komodor, 2026 Agentic Operations Survey (November 4, 2026).

Two surveys released on November 4, 2026 show how few companies let AI agents act without human approval. Tata Consultancy Services surveyed 1,333 senior business and technology leaders in 25 countries and found that only 10% of enterprises allow AI agents to execute decisions without human approval across multiple functions or business areas, and that just 9% report agents capable of securely orchestrating workflows across enterprise applications. The same day, Komodor reported on more than 1,000 engineering and technology leaders. Of those, 75.7% keep some restriction on autonomous operations, such as read-only tasks, human approval for changes, or automated actions limited to noncritical workloads. On Basil C. Puglisi’s reading, the caution is sound. It still leaves a harder deployment question open, which is what an agent action has to show before the human approval step comes off.

Puglisi described that gap in February in When AI Acts Between Approvals: The Gap Everyone Sees and No One Has Closed. At L1, the AI recommends and a human approves each action. The post describes the jump to L2 as the point where AI systems shift “from recommending actions that humans approve individually to taking bounded actions between periodic human reviews,” and it argues that this jump demands more new governance infrastructure than any later transition. It also sets a tactic that fits this week’s numbers: an autonomy level audit of every AI vendor and internal tool, “classifying each based on whether it can act without prior human approval.” The surveys show most organizations still restricting agent autonomy, though a restriction doesn’t always mean a person approves every action. A company that crosses the line without a written rule for when an action may stop asking will cross it one vendor default at a time.

Komodor puts autonomy at the level of the action

Komodor’s respondents work in engineering, IT and technology roles, and nearly 84% report running fleets of 10 or more operational agents. Building safe guardrails was the most cited challenge (53.6%), followed by governance and security (50.4%), and 42.7% of respondents named insufficient visibility into agent permissions. The practitioner advice on Komodor’s report page goes further than the headline numbers. It says to “make autonomy a per-action decision, not a per-agent one,” and to “promote an action to autonomous only after it has a clean approval record.” The same page tells teams to register every agent like a service, with a named owner, a scope, a version and a kill switch.

Puglisi sets autonomy at the same level, because the agent that drafts a refund note can be the same software that issues the refund, and the risk travels with the action. Komodor sells a platform for running and governing agents, so its advice also describes the product it sells, and its survey respondents work in engineering and IT operations rather than across the business. The phrase “clean approval record” still carries the useful idea, because it turns autonomy into something an action earns from evidence a person can inspect.

Salesforce is making delegation routine

Salesforce reported the same day that more than 185,000 users now work with Agentforce Coworker, after 21x growth in usage in three months. Coworker plans the steps, coordinates Agentforce agents and workflows, and brings back “results and recommended actions for review.” Salesforce says approval and audit capabilities are available for supported operations, new apps let employees review results and approve actions from any device, and scheduled tasks for recurring work are expected in December.

If each approval is logged with what the reviewer saw, that design can produce the record Komodor describes. It also makes approval easy to give from a phone between meetings. A record full of approvals proves little if the person approving could not see enough to modify or reject the action. The value of the record depends on whether each approval was a ruling.

Automated guardrails cover a different question

Vendors are also selling machine controls that screen what goes into and out of an agent. Algolia’s documentation for its Agent Studio guardrails says a separate model classifies user messages and agent replies against categories the customer defines. It also states that guardrails “use a fail-open design,” so when the classification model is unavailable, content is allowed through rather than blocked. Algolia chose that design to keep a guardrail outage from disrupting the agent, and it is a reasonable engineering trade. In Puglisi’s terms, a classifier checking an agent is machine checking machine, which he files under Responsible AI. That layer has value, and it cannot decide whether an action has earned the right to skip a person.

How Puglisi would set the promotion rule for a client

The work starts with an inventory of actions, built from the audit his February post recommended. The owner lists each agent action on its own line and tags it as a read, a write to a noncritical target, or a consequential action that touches money or a customer’s account. Every write and consequential action starts in a held state, where the agent proposes and a named person rules.

The rule for leaving that state gets written before the pilot starts, under Checkpoint-Based Governance, Puglisi’s framework for placing a named human decision at defined points in an AI workflow. For each action type, the owner writes the number of consecutive reviewed cases required and the review window, along with the share of modify or reject rulings that resets the count. The rule also records who signs the promotion and what event moves the action back to held, such as a reversal, a customer complaint, a model or prompt change, or a new vendor release. Consequential actions can stay held indefinitely, which is a legitimate outcome of the rule.

During the held period, the reviewer logs every ruling as accept, modify or reject, with a name and a time. A promotion is itself a checkpoint decision, so the owner reads the log and accepts, modifies or rejects the promotion. Promoted actions keep a sampled review afterward, because the evidence that earned the promotion describes the agent version that produced it.

What a client tracks

A client can follow the program with a short set of measures. The first is the share of agent action types that have a written promotion rule before the pilot. The second is the modify and reject rate for each held action type. That rate alone can’t prove review quality, so a sample of approved cases gets checked against what actually happened. A held action with no modify or reject rulings across many cases deserves a look at how the reviews are done before anyone treats it as clean. The third is the reversal rate for promoted actions in their first quarter, and every demotion gets reported to the owner who signed the promotion.

Promotion belongs to a named owner

The TCS and Komodor surveys found most respondents restricting agent autonomy, and Salesforce’s growth figures show how fast delegated work is spreading anyway. Komodor’s advice names the right unit and the right evidence. Puglisi adds a signature to that evidence, so a named owner who wrote the promotion rule before the pilot also signs each move from held to autonomous. TCS describes the next stage as AI taking on more authority to act where appropriate. The test to watch is whether reviewers keep ruling case by case as volume grows, and the modify and reject rate will show the change first.

Sources

Questions readers ask

What did the TCS Enterprise AI Study find about AI agent autonomy?

TCS surveyed 1,333 senior leaders in 25 countries and released the results on November 4, 2026. Only 10% of enterprises allow AI agents to execute decisions without human approval across multiple functions or business areas, and 9% report agents capable of securely orchestrating workflows across enterprise applications.

What does a clean approval record mean for an AI agent?

Komodor’s survey report advice, released with its November 4, 2026 survey, says to promote an action to autonomous only after it has a clean approval record. In practice, that means a log of reviewed cases for one action type, each ruled accept, modify or reject by a named person, that meets a promotion rule written before the pilot.

Should autonomy be granted per agent or per action?

Basil C. Puglisi sets it per action, because one agent can draft a note and also issue a payment, and those carry different risk. Listing each action, tagging it by consequence and holding writes and consequential actions for review lets a company promote low-risk actions without handing the agent everything.

Are automated guardrails enough to let an agent act without approval?

Automated guardrails are machine checking machine, which Basil C. Puglisi files under Responsible AI. They catch defined problems, and some are built to let content through when the checking model is down, as Algolia’s documentation describes. The decision to remove a human approval step stays with a named owner.

What is Checkpoint-Based Governance?

Checkpoint-Based Governance is Basil C. Puglisi’s framework for placing a named human decision at defined points in an AI workflow, where the person accepts, modifies or rejects what the AI produced. Applied to agent autonomy, the promotion of an action from held to autonomous is one of those checkpoints.

#AIg

Reader Interactions

Leave a Reply

Your email address will not be published. Required fields are marked *