Back to Insights
AI Governance6 min read

AI agents: demand an execution contract before granting rights

TokenShift Executive Note

AI agents: demand an execution contract before granting rights

Giving an AI agent more autonomy without bounding its power to act does not shorten the path to production. Mostly, it shortens the path to an incident. The signals from July 2026 all point the same way: the illusion of a one-shot result, a terminal objective pursued to the letter, and evaluation by other models are no substitute for execution discipline.

A prompt does not govern an agent

On 19 July 2026, a preprint posted to arXiv proposed comparing anonymised answers through the votes of five models. The author himself points out that the score measures a preference between models, not objective accuracy and not human judgement. That is useful for comparing phrasings. It is not a mandate to act on a customer, a payment or a regulatory file.

Separate work, published by Springer Nature in February 2026, tracked 65,987 popular open source projects. The 10,612 projects with roughly 700 or more commits on their main branch showed steadier trajectories than smaller projects. The study does not measure the effect of AI directly. It does show how much the processes, size and constraints of a mature system shape its throughput.

The same gap shows up at enterprise scale. According to McKinsey's 2025 global survey, 88% of respondents report regular AI use in at least one function, yet only 39% report an enterprise-level impact on EBIT. The top performers, roughly 6% of the sample, are nearly three times as likely to have fundamentally redesigned their workflows. They are also more likely to define when an output must be signed off by a human.

The lesson is not that every answer needs a sign-off. It is that the prompt must be replaced, as the unit of governance, by an execution contract. Not a legal contract, but an operational artefact: versioned, owned by a named business leader, and setting out what the agent is aiming for, what it may do, what it must prove and when it stops.

Building the 5D execution contract

The 5D contract fits on one page before it becomes a technical configuration. It has to be understood by the business, by risk, by compliance and by the product team.

1. Destination

Write down a workflow outcome, not a vague exhortation. "Cut median handling time from 72 to 24 hours without increasing the reopen rate" is workable. "Optimise handling" is not. Add the population in scope, the starting position, the time horizon, and the conditions that would make the outcome unacceptable.

2. Rights

Take stock of the data, tools and actions in reach. Draw the line between read, propose, modify, send and commit spend. Set caps per transaction and per day. Spell out the prohibitions too: contacting a customer, deleting a document, changing a beneficiary, or working around segregation of duties. An agent never gets more rights than its use case requires.

3. Demonstration

Define the evidence expected for each output: sources consulted, business rule applied, timestamp, model version and tool-call log. A "preferred" answer is not necessarily a correct one. For sensitive decisions, test the agent on representative cases, on exceptions and on adversarial inputs, then measure errors by severity.

4. Decision

Name the person who can accept, reject, correct and escalate. Set the thresholds: mandatory human sign-off above 500 euros, four-eyes checks on a beneficiary change, immediate escalation when two sources contradict each other. Article 14 of the AI Act requires, for high-risk systems, effective human oversight that includes the ability to disregard, override or reverse an output, and to stop the system.

5. Deactivation

Write the stopping conditions before you launch: rate of missing evidence, security incident, KPI drift, model change, or a critical source going down. Assign the kill switch, the fallback to manual handling, and the recovery of cases already in flight. NIST's GenAI profile explicitly recommends a named owner for incident response, regular exercises, and fallback options that may include manual handling.

Mini-case: the agent that clears cases faster without draining the queue

Take a bank's compliance function — a fictional case with illustrative figures. It receives 1,200 alerts a week; time to resolution at the 90th percentile reaches 72 hours. An agent summarises the documents, queries the reference data and proposes a closure.

Without an execution contract, the team tracks summaries produced and minutes saved. The agent looks profitable, but analysts re-check everything, exceptions pile up, and nobody measures reopened cases.

With the 5D contract, the agent starts in observation mode. It may read and propose, never close. Every recommendation cites the rule and the documents it used. An analyst decides; the compliance lead handles contradictions. The pilot stops if more than 1% of recommendations lack evidence, or if reopenings exceed the baseline.

After four weeks, the outcome is judged on observable markers: median and 90th-percentile handling time, fully loaded cost per alert resolved, human review time, first-pass acceptance rate, correction and reopen rates, age of the exceptions queue, incidents and complaints. If summaries land faster but the queue still sits at 72 hours, the company has gained no productivity.

Mistakes to avoid

  • The naked objective: setting a volume target with no quality, legal or fairness constraints.
  • The prompt-as-charter: burying the rules in an unversioned block of text that neither the business nor audit controls.
  • The decorative reviewer: putting a human in the loop with no time, no expertise and no authority to overrule the agent.
  • The local KPI: counting outputs, tokens or minutes saved without measuring the full cycle and the rework.
  • The orphan kill switch: planning for a stop with no owner, no manual procedure, no log retention and no restart rule.

A board decision in 30 days

For the first five days, pick a single workflow, name its owner, and establish the economic and operational baseline. From day six to day ten, draft the 5D with risk, compliance, security and operations. From day eleven to day twenty, run in observation mode on a representative sample, with no right to take irreversible action. For the last ten days, open up limited rights, track the indicators daily, and hold a documented weekly review.

Go-live is authorised only if end-to-end value improves, if serious errors stay below the agreed threshold, and if the team knows how to stop the workflow and then restart it. Otherwise, fix the contract before you touch the model.

An agent is not in production when it knows how to act. It is in production when the company can prove why it acted, who could have stopped it, and whether the result was worth the risk.

At your next board meeting, ask to see the execution contract for the first agent holding real rights. If there isn't one, the agent isn't ready.

Sources

Continue reading

View all insights