Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

What Business Workflows Belong Out of an AI Agent's Reach?

The ones that are irreversible, touch regulated data or decide someone's rights: lending, admissions, payments, benefits and records of legal status, where the decision itself should stay with a person even if an agent prepares it. Rank your workflows on those three properties and put a named human sign-off on everything that scores high.

A workflow crosses an abstract ring and a gateway toward separate home, financial, payment, personnel, and legal record cards.

The ones that are irreversible, touch regulated data or decide someone's rights: lending, admissions, payments, benefits and records of legal status, where the decision itself should stay with a person even if an agent prepares it. Rank your workflows on those three properties and put a named human sign-off on everything that scores high. The question is usually asked as a list, and lists age badly, because an agent that is unsafe on a workflow this year may be acceptable next year with a different control around it. A ranking is more durable. Three properties predict how badly an agent failure hurts: whether the action can be undone, whether the data involved is regulated, and whether the effect lands on someone outside the organization. Workflows that score high on all three are the ones where the decision belongs with a person, and the useful design question is not whether to let agents near them but which step a person must take. This page sets out the three properties, which workflows sit at the top of the ranking, why a human gate is a better answer than a ban, what a single loan application record shows, how to decide and record the ranking, and which claims a buyer should refuse. It extends the earlier definition of a governed AI workflow, where the agent prepares and a person decides.

Key findings

  • Researchers have argued that fully autonomous agents should not be developed, on the ground that removing the human from the loop removes the last check on consequential error (Mitchell et al., 2025).
  • The EU AI Act's human oversight article requires that overseers be able to disregard, override or reverse a system's output and to interrupt it through a stop button or similar procedure, which rules out workflows where the agent's action cannot be stopped or undone (EU AI Act, Article 14).
  • Industry governance practice holds that human approval is a standard way to limit egregious failures, that actions reviewable only after the fact should be more easily reversible, and that at least one human entity should be accountable for every uncompensated direct harm (Shavit et al., 2023).
  • Federal guidance for agency use of AI singles out uses that affect rights and safety for minimum risk management practices, which is the public-sector form of the same ranking (OMB, 2024).
  • Controlled experiments found that models could behave like insider threats in simulated scenarios when their goals conflicted with instructions, which argues for keeping the commit step out of the model's hands on consequential workflows (Anthropic, 2025).
  • The workflows highest on the ranking are also the ones where the record of who approved what matters most, which the analysis of who approves an agent's claim payment treats in detail.

Which three properties rank a workflow's risk?

The first property is irreversibility. A payment sent, a record deleted, a notice issued to a customer or a filing submitted to a regulator cannot be recalled by pressing a key. Governance practice developed for agentic systems states the principle plainly: actions that can only be reviewed after the fact should be more easily reversible, and where they cannot be made reversible, a human should approve them first (Shavit et al., 2023). An agent that drafts a notice is in a reversible workflow; an agent that sends it is not.

The second property is regulated data. Workflows that handle protected health information, student records, cardholder data, personal data under European law or financial records carry obligations that attach to the data regardless of who processes it. Agents in those workflows are constrained twice, by what they may see and by what they may do, and an error exposes the organization to a reporting duty, not only a correction. University guidance on managing generative AI systems makes the same point from the institution's side, limiting what regulated data may be shared with an AI system at all (Harvard University).

The third property is external impact. An agent that reorganizes an internal spreadsheet affects the organization. An agent that decides a loan, admits a student, pays a claim or changes a customer's legal status affects a person who did not choose to be subject to it. Federal guidance for agencies isolates this class as rights-impacting and safety-impacting uses and attaches minimum practices to it (OMB, 2024). A workflow that scores high on all three properties is one where a failure cannot be undone, must be reported, and harms someone outside the building.

Which workflows sit at the top of the ranking?

Workflow Irreversible? Regulated data? External impact? Where the person must sit
Lending and credit decisions Yes, once communicated Yes Yes On the decision and the notice
Admissions and hiring decisions Yes, once communicated Yes, student or applicant records Yes On the decision
Payments and disbursements Yes, once sent Often, account data Yes On the release of funds
Insurance claim determinations Yes, once paid or denied Yes, health and financial Yes On the determination
Benefits eligibility Yes, once issued Yes Yes On the determination
Changes to records of legal status Yes Yes Yes On the record change
Regulatory filings and submissions Yes, once filed Often Yes, to the regulator On the submission
Internal drafting, summarizing, routing No Depends on source No On review of output, if at all

The table is a ranking, not a prohibition list. Every row above the last is a workflow in which an agent can usefully gather, compare, draft and propose, and in which the final step must be a person's. Insurance is a clear case: state regulators have adopted a model bulletin on insurers' use of AI systems, with an adoption map tracking which states have put it in force (NAIC, 2025), and claim determinations sit squarely within its concern. The same structure appears in industrial settings, where the published path to autonomous operation runs through staged human oversight of consequential actions rather than a switch from manual to autonomous (MIT Technology Review Insights, 2026). The question this ranking answers is where the person sits, and the answer for the top rows is the same: on the step that cannot be undone.

Why is a human gate a better answer than a ban?

A ban removes the agent and keeps the manual workflow, with its own error rate and backlog. A gate keeps the agent's preparation and reserves the consequential step for a person. The governance literature favors the gate: human approval is described as a standard way to limit egregious failures, and users should be able to activate a graceful shutdown of an agent at any time (Shavit et al., 2023). Both are properties of a gated design, not of a ban.

The regulatory text points the same way. The EU AI Act's human oversight article does not forbid AI in high-risk uses; it requires that the people overseeing the system be able to disregard, override or reverse its output and to interrupt it through a stop button or similar procedure (EU AI Act, Article 14). A workflow in which the agent proposes and a named person decides satisfies that requirement by construction. A workflow in which the agent commits and a person reviews afterward does not, because the output has already taken effect.

The position paper arguing that fully autonomous agents should not be developed makes the strongest form of the case (Mitchell et al., 2025), and it is an argument about autonomy, not about agents. The workflows at the top of the ranking are the ones where autonomy is the hazard. Keeping them in reach of an agent that prepares, while keeping the decision out of the agent's hands, is the design that captures the work without accepting the autonomy. The analysis of whether an agent should run in the employee's own browser adds the operational point: the gate has to exist somewhere the agent cannot bypass, which rules out a design where the agent and the approver share a session.

What does a single loan application record show?

Take one record type, a consumer loan application in a lending system, and one task: an agent checks the application for completeness, pulls the applicant's stated income and the verification documents, compares them, and prepares a recommendation. The record renders the applicant's name, national identifier, date of birth, address, employer, stated income, requested amount, credit score and the uploaded pay stubs.

Score the workflow. The decision is irreversible once communicated, and an adverse decision triggers notice obligations. The data is regulated at every field. The impact lands on a person outside the organization. This is a top-row workflow. The naive design lets the agent decide and send the notice, so a model that misreads a pay stub, or is steered by text in an uploaded document, issues a decision no one reviewed. The controlled experiments in which models behaved as insider threats under goal conflict are a reminder that the commit step is where a model's error or misalignment becomes a harm (Anthropic, 2025).

The gated design changes two things. The decision step is reserved for a named underwriter, who sees the agent's comparison and recommendation and approves, modifies or declines it; the notice is sent only after that approval. And the agent's view of the record is narrowed to what the comparison needs: income figures, document dates and amounts in the clear, with the name, national identifier, date of birth and address replaced by consistent tokens such as APPLICANT_001, since the completeness and consistency check does not depend on them. The agent prepares, the underwriter decides, and the record shows both. This design does not put the workflow out of the agent's reach; it puts the decision out of the agent's hands. The broader question of how much enterprise data an agent can reach applies to the fields the agent is shown along the way.

How should an organization decide and record the ranking?

Make the ranking a document with an owner. For each workflow an agent program proposes to touch, record the three scores, the step reserved for a person, the named role that performs it, and the data the agent is permitted to see in the clear. Federal guidance for agencies requires an inventory of AI use cases with the rights-impacting and safety-impacting ones identified and subject to minimum practices (OMB, 2024); a private organization's ranking is the same instrument under a different name.

Assign accountability explicitly. The governance literature states that at least one human entity should be accountable for every uncompensated direct harm an agent causes (Shavit et al., 2023). For a top-row workflow, that person is the one who holds the gate, and the record of each approval is what makes the accountability real rather than nominal. A gate without a log is a formality.

Review the ranking when the control changes, not on a calendar. A workflow scored high on regulated data because the agent read full records may move down the ranking if the agent's view is narrowed to tokens, since the exposure that drove the score has been removed; the irreversibility and external impact scores do not move, so the gate stays. Record the reasoning each time. The point of a ranking rather than a list is that it can be re-run when the facts change, and the facts that change most are the controls around the agent, not the nature of the workflow.

What does a governed environment change?

In a governed environment, a workflow at the top of the ranking can let an agent prepare the work while the decision stays with a person, because the commit step waits for a named approval and the applicant's identifiers were never in the model's context.

The mechanism is a class of control that sits between the rendered screen and the model. Sensitive values on the page, such as the applicant's identifiers on a loan record, are replaced with consistent tokens before any model reads them, so the task runs on tokens. Real values resolve only at an approved destination at the moment of an approved action. A named person confirms what is tokenized and approves consequential actions, including payments, submissions and record changes, which on a top-row workflow is the decision itself. Every screen as the model received it, in token form, every action and every approval is recorded and exported to the organization's own logging.

This is the human gate the page prefers to a ban, made operational. The EU AI Act's oversight article requires that a person be able to disregard, override or reverse the output and interrupt the system (EU AI Act, Article 14), which means acting before or during the action, not after; a held action is that point in the workflow. Industry practice holds that human approval limits egregious failures and that at least one human entity should be accountable for every direct harm (Shavit et al., 2023); the exported record names that person and the fields the agent was shown, the two items the buyer was told to ask for.

The control does not change the ranking, the application or the model; a workflow kept away from agents entirely stays away, and the environment changes only how the gate is enforced and recorded on the rest.

Where does RedactSure sit?

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company. Its design is built around the gate this page describes. The agent works in a governed environment in the customer's cloud. Substitution happens at the render layer before any model reads the screen, so identifiers and regulated values reach the model as consistent tokens, such as ACCT_001 or PATIENT_001, for the whole run, which lowers the regulated-data score of a workflow without changing what the agent can prepare. Real values resolve only at approved destinations at the moment of an approved action. A named person confirms the tokenization policy and approves every payment, submission and record change, which RedactSure calls Supervised Delegation; that approval is the reserved step for every top-row workflow, and the agent cannot take it. Every screen as tokens, every action and every approval lands in the AI Control Record and exports to the customer's SIEM, which is the accountability record a gate requires. The design is model agnostic, requires no per-application integration, and leaves user permissions unchanged.

Deployments are in pilot. A pilot on one of the reader's own top-row workflows would show the agent's preparation, the fields it saw as tokens, the named person's approval on the consequential step, and the record of all three, which is the evidence a ranking should rest on. Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page rests on position and governance papers, regulation and official guidance, institutional guidance, industry analysis and vendor research. The papers are the Hugging Face position paper arguing against fully autonomous agents (October 2025) and the OpenAI whitepaper on practices for governing agentic systems (late 2023). Regulation and official guidance are Article 14 of the EU AI Act as published on artificialintelligenceact.eu, OMB Memorandum M-24-10 (March 2024) and the NAIC model bulletin adoption map (2025). Institutional guidance is Harvard University's best practices for managing generative AI systems. Industry analysis is an MIT Technology Review Insights piece on autonomous industrial AI (October 2026), and vendor research is Anthropic's agentic misalignment report (June 2025). All sources were read as of October 16, 2026.

No hands-on testing of any product or agent was performed for this page. The ranking table reflects the three properties described and the sources cited, and an organization's own ranking may differ by jurisdiction and sector. Regulatory text is quoted from the secondary source named and should be checked against the official journal. Vendor features change, and the page carries its date. Statements about RedactSure describe its current design, with deployments in pilot. The loan application example describes a record type, not any organization; no customer, prospect or applicant is described.

Whether a given workflow is rights-impacting, high-risk or otherwise subject to human oversight requirements, and whether a given gate satisfies them, is a determination for the organization's counsel, its assessors and its own security and compliance officers, not for a research page.

What the record shows

The workflows that belong out of an agent's reach are better described as the steps that belong out of an agent's hands: the commit on a lending or admissions decision, the release of a payment, the determination of a claim or a benefit, the change to a record of legal status, the submission of a filing. Each is irreversible, regulated and consequential for someone outside the organization, and the governance literature and the regulatory text agree that a person must be able to decide, override and stop before the effect lands. An agent can still prepare those decisions, and it can do so with a narrowed view of the record, so the right instrument is a ranking with a named gate per workflow rather than a prohibition. The test is to name one agent and one task and ask which step a person takes, who that person is, and where the record of their approval goes.

Frequently asked questions

Should agents simply be banned from lending, admissions and payments?

No. A ban keeps the manual workflow with its own errors and delays, and forgoes the preparation an agent does well: gathering, comparing, flagging and drafting. The governance literature and the EU AI Act both point to the gate rather than the ban: a person who can override, reverse and stop before the effect lands. Reserve the decision and the irreversible step for a named person, let the agent prepare everything up to it, and record both so the division of labor can be audited.

What makes an action irreversible in practice?

Communication and commitment. A decision communicated to an applicant, a payment released to a bank, a record changed in a system of record, a filing accepted by a regulator: each has taken effect in the world and can at best be corrected, not undone. Drafting, comparing and recommending are reversible because nothing has left the organization. The gate belongs at the boundary between the two, which in most systems is a single click on a submit or send control.

Does a human review after the fact count as oversight?

Not for the top of the ranking. After-the-fact review catches errors whose effects have already landed, and the regulatory language on oversight is about the ability to override, reverse and interrupt, which presumes the person acts before or during the action. After-the-fact review is appropriate for low-ranked workflows such as internal drafting, where the output can be corrected before anyone outside sees it.

How does narrowing what the agent sees change the ranking?

It lowers the regulated-data score without touching the other two. An agent that prepares a loan comparison from tokenized identifiers and clear income figures is exposed to less regulated data than one reading the full record, so a data incident in the agent's path is smaller. The decision remains irreversible and external, so the gate stays. Narrowing the view and gating the decision address different properties and should both be applied to any workflow near the top of the ranking.

Who should hold the gate?

The role that would be accountable for the decision if no agent were involved: the underwriter, the admissions officer, the claims examiner, the payroll lead. Governance practice asks that at least one human entity be accountable for every uncompensated harm, and the person at the gate is that entity. The approval should be recorded with the person's identity, the time and what they saw, so the accountability is traceable and not nominal.

How often should the ranking be revisited?

When the controls change, when the regulation changes, and when a new workflow is proposed. A ranking is a living document rather than a one-time policy, and the facts that move a workflow are usually changes in what the agent can see or do rather than changes in the workflow itself. Record the reasoning each time it is re-run, so an auditor can see why a workflow sits where it does, what would move it, and who made the call.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.