Agentic work for organizations
Bounded autonomy: freedom to act without giving up control.
AI agents can change source code, delivery pipelines, infrastructure, and live services. The opportunity is significant, but so is the change in responsibility: an organization is no longer asking AI only for an answer. It is delegating action.
Bounded autonomy is a practical way to introduce that delegation progressively. People retain control of consequential decisions while agents receive enough freedom to investigate, execute, validate, and learn inside an agreed mandate.
From model to agent
The model is only one part of the system.
A model predicts a response from the context it receives. A harness turns that capability into an agent by providing tools, continuity, access to an environment, and mechanisms for taking action. The harness therefore helps determine what the agent knows, what it can do, and how its work is controlled.
This distinction matters to decision-makers. Choosing a model is not the same as defining an AI operating model. Organizations must also decide which context is available, which systems are reachable, whose authority is being used, and how actions will be supervised and verified.
Challenge
Human control is often placed at the wrong level.
Asking a person to approve every command creates interruption and approval fatigue. After enough requests, approval can become mechanical rather than thoughtful. At the other extreme, giving an agent an entire objective allows it to make many connected decisions before a person sees the result.
Human-led assistance
Continuous involvement
The person remains close to every action, but the agent has limited room to work independently.
Request to completion
A broad mandate
Execution is fast, but assumptions and consequential decisions can accumulate unchecked.
Bounded autonomy
Control at decision points
The human selects the next meaningful step; the agent controls execution inside it.
Challenge
A convincing result is not necessarily a verified result.
An early misunderstanding can propagate through code, tests, pipelines, configuration, and infrastructure. The agent may produce a coherent result while moving farther away from the reality of the system.
The prediction horizon describes how far an agent is allowed to proceed before it reconnects with evidence. Shortening that horizon limits how many assumptions can compound before tests, observed behavior, external constraints, or human judgment answer back.
Reconnect with reality
Tests
Does the change satisfy an explicit expectation?
Observed state
What actually happened in the environment?
Constraints
Which technical or organizational limits apply?
Human decisions
Is the next direction still the right one?
The response
One bounded step at a time.
A useful increment is small enough to understand and validate, but meaningful enough to produce observable value. Before execution, the agent investigates and proposes the step, including its outcome, scope, dependencies, exclusions, and validation. After approval, it can work without mechanical interruption. It then returns with evidence and stops before choosing what happens next.
UNIT OF WORK
One observable outcome.
UNIT OF AUTHORITY
One agreed mandate.
UNIT OF RISK
One bounded blast radius.
UNIT OF LEARNING
One opportunity to improve.
Organizational learning
People learn to delegate before autonomy expands.
Providing access to AI does not create the ability to work with agents. Teams must learn how to define outcomes, communicate boundaries, identify consequential decisions, review evidence, and recognize when an agent is uncertain.
Adoption can progress from assistance, to proposals, to bounded action, and eventually to delegated autonomy in proven situations. Trust grows per use case and from experience—not through a single organization-wide declaration that AI is ready.
Delegated authority
Treat the agent as an organizational actor.
Like a person receiving a work assignment, an agent needs a defined task, appropriate context, access suited to its role, supervision, and a way to verify the outcome. It should not automatically inherit the complete authority of the developer or administrator operating it.
The analogy has limits: an agent is not legally or managerially accountable. It can also repeat a mistake at machine speed. The organization therefore remains responsible and must make delegated authority explicit.
Controls that work together
Important boundaries must exist outside the model.
Instructions and plans guide behavior, but they are not security boundaries. Organizations already manage risk through multiple independent layers; agentic systems should follow the same principle.
DIRECTION
What should happen?
Objectives, procedures, runbooks, and organizational knowledge.
SUPERVISION
Who reviews?
Human checkpoints and independent review of sensitive actions.
BOUNDARIES
What is possible?
Sandboxing, controlled identities, access, and external communication.
RESILIENCE
What if it fails?
Evidence, records, version history, rollback, backups, and recovery.
Beyond YOLO Mode: Building Boundaries for Enterprise AI Agents
A practical exploration
Pi-Run translates the principles into working controls.
Pi-Run is not the methodology itself or a claim that one tool solves every risk. It is a practical environment for exploring how an agent can remain useful while operating inside organizational boundaries.
Purpose-specific context
Profiles and skills select the identity, instructions, credentials, and knowledge appropriate to the work.
Independent supervision
Guardian reviews covered actions without asking a person to approve every routine command.
Enforced boundaries
The container and network sidecar limit filesystem and network exposure outside the agent’s reasoning.
Controlled consultation
Call a Friend can send a bounded question to another model without automatically transferring the workspace or complete transcript.
An internal primary agent can retain sensitive working context while an external model receives only a minimal question. The proposed disclosure can be reviewed first, and the response returns as advice to verify—not as authority. Application controls still need approved providers, network boundaries, contractual safeguards, and human accountability.
Across the technology lifecycle
One method, different consequences.
Development, DevOps, infrastructure, and operations all follow a similar agentic cycle: observe, propose, act, and validate. What changes is the environment, the available evidence, and the cost of a mistake.
DEVELOPMENT
Change code
Use tests, diffs, branches, and review to validate an increment.
DEVOPS
Change delivery
Stage and verify changes to builds, pipelines, releases, and deployments.
INFRASTRUCTURE
Change resources
Bound the target and verify actual state rather than trusting the intended configuration.
OPERATIONS
Change live systems
Use smaller interventions, stronger authority boundaries, health checks, and recovery.
Greater blast radius requires smaller steps, stronger boundaries, and clearer recovery.
Benefits
- Useful autonomy with clearer accountability
- Less approval fatigue and shorter feedback loops
- Progressive adoption across development and operations
- A durable method that does not depend on one model
Trade-offs
- Teams must learn to define and validate useful increments
- Human decision points can become bottlenecks
- Controls may reduce maximum execution speed
- Risk is managed and reduced, never eliminated
Progressive, governable autonomy
Freedom inside the task. Constraints around the task.
Organizations do not need to choose between constant permission prompts and an unlimited mandate. They can introduce agentic work as a controlled learning process, expand authority from evidence, and keep consequential decisions visible.