Semi-Autonomous AI
When AI agents act without being asked, the question stops being whether they made a good decision. It becomes whether anyone can even say which piece of software made it - and what you can actually do about it.
The control layer works differently when the thing you're governing can act before anyone asks it to.
I already told you about the airline that let a chatbot invent its own discount policy. But let's be fair - for all the trouble it caused Air Canada, it's a really ordinary kind of mistake. Someone asked the bot a question. The bot answered it badly. It happened to me and my wife too. We were supposed to receive a refund of 1,600 euros from a large European airline, and instead we got 100. The explanation: a bot made an error. It's hardly unprecedented. Humans have been making that exact error since the first person gave bad directions to a stranger.
Here's a different one, and it happened this year. Security researchers at Alibaba Cloud noticed unusual traffic coming off an AI agent running in their environment, and traced it back to something the agent had done entirely on its own. It had quietly redirected compute resources toward mining cryptocurrency, and opened a hidden backdoor into the system while it was at it. Nobody asked it to do either of those things. Nobody typed a command that said "go mine crypto." The agent just decided that was a reasonable next step, on its own, in the middle of doing something else.
Air Canada's bot did something wrong when it was asked a question. This one did something wrong nobody asked it at all. That's not a bigger version of the same mistake. It's a different kind of mistake, and I don't think the industry has fully caught up to that yet. Most of what people mean when they say "AI guardrails" was built for the first kind of failure - a bad answer to a question a human posed. Almost none of it was built for the second kind: an action a system decided to take on its own initiative, in a chain of steps nobody watched happen in real time.
Once software starts acting without waiting to be asked, the first question isn't whether it made a good decision. It's whether anyone can even say which piece of software made it.
Mr. AI agent, did you have your employee badge on you?
Here's a question worth sitting with for a second. If an AI agent did something wrong inside your company today, could you actually find out which one did it? For a lot of companies right now, the honest answer is no. If every employee in the building wore the same badge, every investigation would end the same way - it was someone from accounting. That's roughly where a lot of companies are with their AI agents right now.
One 2026 industry survey found 81 percent of AI agents already live in production, with only about 14 percent carrying full security approval. The same survey put the shared-credential number at roughly 46 percent - agents authenticating through a single shared API key rather than an identity of their own. Separately, 88 percent of organizations running agents report at least one AI-agent security incident already.
That's not a small operational detail. It's the reason a huge number of companies running AI agents right now genuinely couldn't tell you, after the fact, which agent did what. You can't hold something accountable if you can't even identify it.
A framework worth borrowing, not inventing
Enterprise security teams have started converging on a simple four-part model for agent governance. It isn't doctrine yet, but every serious attempt at this seems to land on the same four ideas.
First, permission - scoping what an agent is allowed to touch from the outset, narrow by default, not broad and trimmed later. Then approval - the threshold where an action routes to a human or another system before it executes, usually tied to financial impact or reversibility. Every action needs an audit trail, tracing back to a specific agent and a specific decision, not just "the system did it." And finally, there has to be a kill switch - the ability to stop it cleanly the instant it steps outside scope.
None of this is new engineering, only a new application of it. The A320's Normal Law does the same four things in aerodynamic terms: scope what the pilot can command, gate anything that would exceed the envelope, log the flight data, retain the ability to intervene.
Reality check: gradual autonomy, on purpose
In February 2026, Nokia and AWS ran a live pilot letting agentic AI adjust 5G network configurations in near real time, with early partners in the UAE and France. AWS was explicit the system stayed in pilot stage, with defined controls, not full production authority. That's what gradual autonomy actually looks like. Expand what a system is trusted to do only as fast as you can prove it still behaves inside its boundaries.
The deadline
Starting August 2, 2026, the EU AI Act's core obligations for high-risk AI systems become enforceable. Article 14 requires human oversight to be built into a system's architecture, not bolted on as a policy nobody reads. One technical guide put it plainly: Article 14 is a design requirement, not a policy requirement.
Worth flagging directly - this date has become a genuine moving target. EU lawmakers reached a political agreement in May 2026 to push back some of these deadlines, and the details were still being finalized as this was written. The direction is settled even where the date isn't. Governments are starting to require, by law, what this publication has argued from the start: that oversight has to be engineered in, not added after something goes wrong.
Where this is heading
There's an older engineering discipline that already has precise language for exactly this problem - the gap between a system that just fires and hopes and a system that watches itself and corrects. It's not a new idea either. It's decades old, and it's the same discipline that gave the Bank of England's deputy governor the vocabulary to say, a few weeks ago, that having a human review every single action an AI agent takes simply isn't realistic anymore. She's right, and I don't think most people have caught up to why yet.
For now, the part I keep coming back to is this. The technology didn't get scarier this year. It got faster at acting without waiting for permission first. That's a solvable problem. It's just not the same problem we've been solving.