The autonomy boundary: what AI can do and what stays human
This is a live Practicum page for Volume 2. Verified: 2026-08-18. The boundary moves every few months, so check the date. It supports Chapter 2 of Volume 2, "More Work Done Does Not Mean More Value." The book explains the principle. This page gives a current view and a way to test it.
Discipline: this is practice, not a formal standard. Check the current version of any tool or standard before using it.
Work that required a person yesterday may be safe to give AI tomorrow, with review. The reverse can happen too. This page shows what teams commonly delegate now and how they check the result so that output can become an outcome.
Where the boundary sits now
| Profession | Often delegated to AI, with review | Usually kept human |
|---|---|---|
| Lawyer | first-pass research, contract review, version comparison | legal position, strategy, signature |
| Marketer | drafts, options, summary reports | strategy, brand voice, facts |
| Support specialist | standard replies, request classification | conflict, compensation, escalation |
| Analyst | collection, first summary, hypotheses | the "what should we do?" conclusion and the bet |
| Finance specialist | reconciliations, drafts, number extraction | decision, responsibility, statutory reporting |
This is not permission to automate everything. Use the Human Review Matrix to check the cost of an error and whether you can reverse the action.
How to check skills and plugins
Before you give a third-party skill or agent access to your working environment:
- Use a shared risk vocabulary. OWASP for LLM and Agentic AI covers vulnerability classes such as prompt injection. MITRE ATLAS maps techniques used against AI systems. Check the current versions before relying on them.
- Check provenance. Find the author, signature or Skill Card, and requested permissions. Treat an unfamiliar skill like unfamiliar code. See skill banks.
The new weak link is the agent
The weak point has moved from a person who clicks a phishing link to an agent that the person created:
- Inherited permissions. An agent receives the user's privileges. A prompt injection can turn expected behavior into an extra action. Give it only the access it needs, following the least privilege principle.
- Orphaned identities. Every agent needs an owner and an expiration date. Otherwise, it may keep full access after the employee leaves.
- Observability. You need a view of which agents do what. This is not paperwork for its own sake. Without it, agents can create losses instead of outcomes. Record the fields in the Agent Contract.
What moved in 2026: augmentation won, and the memory is now an attack surface
Two things changed on this boundary in 2026, and they pull in opposite directions.
The boundary moved back toward people, not away from them. In Anthropic's usage data published in June 2026, collaborative use overtook full delegation: just over half of use is now working with the model rather than handing it the task. That is the opposite of what the "agents will run the company" story predicted, and it is the pattern this chapter argues for. Note the caveat: this is one vendor's own product data, and its users skew heavily technical.
The agent's memory became part of the attack surface. 2026 produced published research on prompt injection that persists in an always-on agent's own stored memory and survives a restart. That changes the practical rule. It is no longer enough to check what an agent does in one session. If it keeps memory, the memory is state that an outsider may have written to. Give it the narrowest access that still lets it finish the job, and treat its stored notes as untrusted input rather than as facts.
Version: 2026-08-18. Update once a quarter and after a material change to the autonomy boundary. The chapter contains flow metrics. This page covers what to delegate and how to check it.
Sources (verified 2026-08-18)
Use these sources to review autonomy boundaries and agent quality:
- OWASP on risks in GenAI and LLM applications: https://genai.owasp.org/
- MITRE ATLAS threat matrix for AI systems: https://atlas.mitre.org/
- Anthropic Economic Index, Cadences report, Jun 26, 2026: https://www.anthropic.com/research/economic-index-june-2026-report
- Prompt injection persisting in an autonomous agent's memory, arXiv 2026: https://arxiv.org/abs/2605.13471
- McKinsey, "The state of AI," on redesigning processes instead of attaching AI to the old process: https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai
Verification standards change. Check the current version, and set thresholds in your own policy.