Delegate to an AI agent as you would to an executiveThe delegation charter in seven questions

Take a multi-site company: thirty or so branches, a few hundred people, a head office. The CEO and leadership team do not see the order placed this morning in Lyon, the exception granted to a customer in Nantes, or the hire launched in Lille. They remain accountable for all of it. That is why they delegate, and they delegate in two ways. To their executives, they give a mandate (decisions, financial limits, escalations, reporting, accountability). To their employees, they give assignments and procedures. The mandate belongs to the executive, the procedure to the employee. All of governance rests on that distinction.

When an AI agent comes into the company, this discipline often disappears. It gets an objective, a few instructions, access rights, and people watch what it produces. If it succeeds, its scope expands. Sometimes a team even connects it to its own data without anyone at headquarters knowing: a delegation nobody granted. The risk is not that the agent lacks intelligence. It is that the company has entrusted it with, or let it take, a power the company has never governed.

After twenty years in general management, and since I started designing and running AI agents in production myself, my conviction is simple: an AI agent should never get more latitude than a human executive in a comparable role. Here are the seven questions I ask, and that you can put to your next leadership team meeting.

The seven questions

1. The mandate. Can someone outside the project read the mandate and explain what the agent is allowed to do and what it is not allowed to do? “Optimize our purchasing” is not a mandate: analyzing, proposing, changing and ordering are different powers.

2. Autonomy, action by action. Does each sensitive action have an explicit level (autonomous; autonomous with a report; subject to approval; prohibited)? The level depends on the consequence, not on the technical difficulty. Anything that commits the company, affects a third party or is hard to undo requires human approval.

3. Proof. Can the reported result be confirmed by data that is independent of the text the agent produced? An agent can deliver a flawless report that is false. I once had an agent report six files indexed, and all six had failed. Nothing unverified gets presented as done.

4. The log. If there is an incident, can we reconstruct the facts without relying on the memory of the people who were there? Every agent has its own identity, every alert an acknowledgment, every silence a follow-up.

5. Shutdown. Who can stop the agent, under what circumstances, and how does the business keep running afterward? A stop button that has never been pressed is a hypothesis.

6. Memory. Do we know what information currently shapes the agent’s behavior, and who approved it? Ungoverned memory turns a coherent system into a string of decisions nobody can explain anymore.

7. The owner. Is one named person accountable for both the risk and the value created?

The mistake people make in good faith

An executive who discovers what an agent can do will, understandably, want to get the most out of it. That executive will hand its oversight to a team member who monitors the tool, reads its reports, adjusts its settings and flags what goes wrong. That team member is carrying out a monitoring procedure. The team member is not accountable for what the agent decides or sets in motion. That accountability stays with the executive who authorized the agent.

An OB-GYN hands the monitoring of a pregnancy to a midwife: a useful delegation that frees up medical time. If something goes wrong at the birth, nobody believes the doctor offloaded responsibility for the birth by delegating the monitoring. The doctor delegated a task and kept accountability for the decision. The agent is the pregnancy being monitored, the employee who watches over it is the midwife, and the executive remains the doctor. A committee that cannot say, for each agent, who the doctor is has not delegated. It has installed a tool and hoped for the best.

What this means for the CEO of a small, midsize or mid-market company

You don’t need to be a technologist to govern your agents. You need to do what you already know how to do with your executives: write the mandate, set the thresholds, require proof, name the person accountable. ISO/IEC 42001, the first AI management system standard, says nothing different. It turns this into a certifiable framework, which is useful when your large customers start asking for it. The EU AI Act has pushed its heaviest obligations back to late 2027 and 2028. That delay is no reason to wait: taking inventory of your agents and writing their mandates creates value now.

If any of the seven answers is still unclear, the agent is not ready for more autonomy. That is not a failure. It is the information you were missing to make the decision.