Manual review loses the race. Agents can generate cost, drift into premium models, or repeat requests before a human notices, so the control has to move to policy at issuance time. The failure is not only overspend, but the loss of a clear governance boundary around non-human activity.
Why approval has to move from people to policy
The break is in timing and authority. Once an AI agent can chain multiple calls on its own, the human reviewer is no longer the control point for every action. The practical control becomes the policy boundary that exists before the first call, because that is the only place you can still bound cost, scope, and destination reliably.
That shift matters because multi-step autonomy is cumulative. A single approved request can fan out into repeated model invocations, tool use, and downstream side effects that look harmless in isolation but become material as a sequence. Governance fails when each step is treated as a separate manual decision instead of one bounded delegated action.
For that reason, AI Agent Authorisation Guide is the right mental model: decide what the agent may do up front, then enforce that decision per action rather than relying on post-hoc review.
What changes when the agent can loop, retry, and escalate work on its own
Multi-step calling changes the risk from isolated mistakes to compounded behaviour. An agent can repeat a request, switch to a higher-cost model, widen the scope of its task, or keep acting after the original business need has been satisfied. That means the issue is not just spend control, it is loss of containment across a sequence of actions.
The same pattern also weakens accountability. If a system can take several steps before a person intervenes, it becomes harder to tell which step actually crossed the line, which intent was legitimate, and which action created the damage. The more autonomous the chain, the more important it is to preserve a clear action trail and a stable identity for the actor making each call.
AI Agent Observability, Audit and Incident Response Guide helps here because the question is not only whether the agent acted, but whether you can attribute each step, detect unusual repetition, and stop the sequence before the blast radius grows.
Zero Trust for AI Agents fits the same problem, since the core requirement is to verify each request and remove standing privilege rather than assuming the agent should keep going once it has been trusted once.
Why this is a governance boundary problem, not just a budgeting problem
The deeper failure is that autonomous execution collapses the old separation between request, approval, and action. In a manual process, a person can see the request before money is spent or a sensitive operation is repeated. In an agentic process, the request and execution can happen inside the same control window, so the organisation loses the chance to apply a human checkpoint at the point where it still matters.
That is why policy at issuance time is the more reliable boundary. If the policy says what the agent may call, how many steps it may take, what it may spend, and when it must stop, you keep the decision where it can actually be enforced. Without that boundary, approval becomes advisory instead of preventive.
Agentic AI Identity Guide is relevant because the governance boundary depends on how the agent is represented, delegated to, and retired. If the identity model is weak, the control boundary will be weak too.
Risk and Threat Considerations
When agents can make multi-step calls without approval, the main risk is uncontrolled accumulation of low-friction actions. A single delegated task can create repeated spend, repeated access, or repeated side effects before anyone can intervene, and that makes the environment vulnerable to both accidental drift and deliberate abuse.
Failure mechanism: The control assumes a person will see and stop each meaningful action, but the agent can complete several actions before review occurs. That breaks the assumption behind manual oversight and allows policy bypass through repetition, escalation, or chaining.
Impact: Organisations can lose budget control, action traceability, and containment around non-human activity. In more sensitive workflows, the same pattern can also widen access or amplify a bad decision across multiple steps before detection.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Multi-step agent calls without approval hinge on delegated authority and privilege boundaries. |
| ASI02 — Tool Misuse | Unapproved multi-step actions often manifest as repeated or widened tool use by the agent. | |
| Recommendation — Enforce per-action policy checks and remove standing privilege for agent calls. Restrict tool access and validate each tool invocation against policy. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The core failure is excess authority across repeated autonomous steps. |
| AU-6 — Audit Review, Analysis, and Reporting | Clear attribution and review are needed to see what the agent did before intervention. | |
| Recommendation — Limit agent permissions to the minimum needed for the current task. Review agent audit events for repeated calls, escalation and abnormal spend patterns. | ||
| NIST Zero Trust (SP 800-207) | AC-6 — Least Privilege Principle | Zero trust fits per-request verification and no standing trust for autonomous actions. |
| Recommendation — Verify each agent request and avoid persistent trust between calls. | ||
Practitioner Guidance
What to prioritise: Put the policy decision at the moment the agent is issued authority, not after it starts working. If the system cannot bound model choice, step count, spend limit, and tool scope before execution begins, the approval model is too late to be effective.
What to verify: Confirm that every agent call is policy-enforced, attributable, and stoppable without relying on a human reviewer to catch it live. The key test is whether the control still works when the agent acts faster than a person can respond.
Practitioner takeaway: Treat multi-step autonomy as a governance boundary problem first and a cost problem second, because once the agent can act repeatedly before review, manual approval stops being a control and becomes an after-the-fact record.