An AI agent that reads tickets, updates the plan and writes to a vendor is doing real work inside the project. When it gets something wrong, the error ends up in documents, dates and relationships with people. For whoever leads the project, the question is practical: who decided the agent could do it, who answers for it, and how do we reconstruct afterwards what happened?
Here I propose an operating framework in four parts: delegation levels, accountability, traceability and control. It fits into tools a project manager already uses: RACI, risk register, governance plan.
Four delegation levels
The first step is to state, for each activity, how much the agent can do on its own. I use four levels, from the most cautious to the most autonomous.
Level 0 · Suggests. The agent proposes, a person decides and acts. Example: a draft status report that the PM rewrites.
Level 1 · Prepares. The agent produces a complete output, which a person approves before it is used. Example: meeting minutes or ticket updates, checked before saving.
Level 2 · Executes reversible actions. The agent acts on its own within written limits, on actions that can be undone, with sample reviews. Example: classifying and assigning incoming tickets.
Level 3 · Executes irreversible actions. External communications, deletions, production releases, financial commitments. These need explicit approval from a person, case by case.
Every activity starts at the lowest level and moves up only with evidence: a number of reviews without corrections, a period without incidents. The rule for moving up is written before starting, together with the rule for moving back down.
Accountability: the agent executes, a person answers
In the RACI matrix the agent can appear in the R column, the one who does the work. The A, the one who answers for the result, always stays with a person. That person needs three things: the competence to understand what the agent does, training on the tool and the authority to stop or correct it.
It is the same criterion the AI Act sets for those who use high-risk systems: human oversight must be assigned to people with the necessary competence, training and authority (Art. 26). Most agents used in projects do not fall into that category, but the criterion holds up well outside it too: oversight without the authority to intervene is just a signature on a document.
Traceability: every action leaves a trace
For every action taken by the agent, five elements must stay on record:
who delegated the activity, and at which level;
the instruction given to the agent;
the data and documents it used;
the output produced or the action taken;
who approved it, when approval is required.
Many tools already record actions in a log: check what they store and for how long. For high-risk systems the AI Act requires logs to be generated automatically (Art. 12) and kept for at least six months by those who use them (Art. 26). As a reference for other cases, it is a reasonable baseline.
Control: limits, stop, review
Least privilege. The agent only accesses the systems and data its activity needs, with a dedicated account that is recognisable in the logs.
Written limits. How many actions per day, on which projects, with what maximum spend.
Stop. A person knows how to suspend the agent within minutes and has tried it at least once.
Periodic review. As with a vendor: what it did, how many corrections were needed, whether the delegation level should be confirmed, raised or lowered.
How to bring it into the project
The simplest tool is a delegation register, a table in the governance plan with one row per activity: description, level, accountable person, limits, where the log is kept, date of the next review. Risks related to agents go into the risk register like any other risk, with an owner and a response.
The register also serves the sponsor: on one page they see what AI does in the project, who answers for it and how it is controlled. It is the same transparency we ask of an external vendor, applied to a collaborator that never sleeps and never asks for clarification.
So the starting point is one question for every activity given to an agent: if this action goes wrong tomorrow, who notices, who answers, and where do we reconstruct what happened? If one of the three answers is missing, the delegation level is too high.