Where should autonomous AI reasoning stop and human authorization begin?

I’ve been working on a problem that keeps becoming more important as AI agents gain access to tools and real execution capabilities:

Capability and authority are not the same thing.

An agent may be technically capable of modifying a record, triggering a workflow, calling an API, or taking another consequential action.

But should the ability to perform that action automatically imply that the agent is authorized to do it?

The architecture I’ve been exploring separates the two:

→ The agent investigates, reasons and proposes
→ Policy determines whether the proposed action is eligible for execution
→ Consequential actions can require explicit human authorization
→ Authorization is bounded to a specific action and context
→ Execution is followed by readback rather than assuming success
→ Evidence is retained so the decision and outcome can be reconstructed later

One of the difficult questions is deciding where that boundary should sit.

Requiring human approval for everything destroys much of the value of autonomous agents.

Allowing agents to execute everything they are technically capable of creates a very different class of risk.

For builders working on agents or tool-using AI:

How are you deciding which actions should be autonomous, policy-gated, or explicitly human-authorized?

I’m particularly interested in how others are approaching this boundary in production systems.