Agents need an operating model before they need more autonomy.

Most agent conversations are about capability: what the model can do, what tools it can call, how far it can act without a person. Those are the wrong first questions inside an enterprise. The first questions are operating questions, and they are dull on purpose.

Who owns it? Not the team that built it — the person accountable for the work it does. When the agent drafts a chargeback table, the decide step is Owner approval: the business owner who holds the budget signs it, not the IT queue that happens to run the tool. And the ledger that reconciles what was approved against what the bill said belongs to that same owner.

How do we know it is right? An evaluation set that exists before the agent is trusted with anything, run again every time the model, the prompt or the data changes. An agent without an evaluation set is an opinion.

What does it cost, per run? Metered consumption read from the subscription it actually bills to, shown next to the work it produced. Estimates are labeled as estimates.

What happens when it is wrong? A named escalation path, a way to switch it off, and a record of what it did. In a Microsoft tenant most of this is already available — Entra for identity, Cost Management for the money, the audit log for the record — but it has to be wired in, not assumed.

Autonomy is earned against that model. An agent that has an owner, passes its evaluation set, shows its cost and can be stopped is safe to give more room. One that lacks any of the four is not, however capable it is.

Published 14 September 2026 · All insights