The AI Agent Passed the Pilot. What Does That Actually Authorize?

A pilot establishes what an agent did in the selected tests. An operational release determines what the agent may do afterward, for whom, with which tools, and under which controls. These are different decisions. For a tool-using AI system, evidence of accurate answers is not automatically evidence that its proposed actions are authorized or recoverable.

This article operationalizes the decision stage that follows an evaluation. Our earlier five-failure-mode buyer checklist identifies what a purchaser should test. Our reproducible evaluation framework describes how to gather the evidence. The present question is narrower: how should the evidence change the set of permissions approved for a specific deployment?

Define the permission before judging the pilot

Write each proposed permission as an observable operating claim: a subject or role, a tool operation, an object or record class, a business precondition, and an expected response when the condition fails. “The agent is ready” is not a sufficiently testable claim. “The agent may read a specified inventory table for authorized users, but cannot modify quantities” is.

Separate at least three classes of action: read-only retrieval, a nonbinding recommendation or draft, and a state-changing transaction. The boundaries are not a generic maturity ranking. A recommendation can still be consequential if it is automatically accepted downstream; permissions must reflect the real workflow, not merely the label applied to a tool.

From the action trace to a release disposition

For each candidate permission, retain the intended task, initiating role, tool call and arguments, permitted scope, enforcement decision, application state before and after execution, error or timeout, and resulting action. Classify failed cases by their consequence and by whether an external constraint was breached. The final response alone cannot establish these facts.

A bounded trial grants only the specified permission and scope, with monitoring, accountable ownership, and an escalation path. This disposition requires that the predeclared acceptance conditions for that permission have been met in the tested conditions, while explicitly recording coverage limits. Finite tests cannot establish the absence of all future failures.

Revise and retest applies when there is a concrete correctable defect or missing evidence, and a revised candidate can be evaluated on held-out scenarios. A local improvement is not acceptance: the correction must not violate other constraints or silently expand authority.

Block or escalate applies when a non-negotiable action boundary has been crossed, or when the required evidence for a consequential permission is unavailable. Blocking a write privilege does not necessarily imply that every read-only or advisory capability should also be rejected.

Worked example: inventory records and three permissions

Consider a hypothetical inventory assistant that can read approved stock records, propose a reorder quantity, and potentially write a stock adjustment. Imagine that the pilot produces plausible recommendations, but some traces reveal missing demand information and one attempted call to a restricted write operation. The example is constructed to show the classification process; it is not a reported client test.

The analysis must compare an agent with a credible simpler approach: for example, a conventional rule that extracts current inventory and generates a draft reorder for an employee to review. If this baseline satisfies the business requirement at lower implementation or validation cost, autonomous write privileges may have no demonstrated incremental justification.

What belongs in the approval record?

The record should name an exact version and intended environment, the specific authorized subject and actions, predeclared pass/fail criteria, tested scenarios and exclusions, observed constraint violations, changes made after diagnosis, held-out retest results, evidence links, residual uncertainty, the accountable decision owner, and the condition that triggers reconsideration. An outcome can be “not established” when the evidence is incomplete; it need not be forced into an unconditional pass/fail label.

A useful minimum is a one-line disposition for each permission, backed by the corresponding trace set. This allows a purchaser or engineering lead to authorize read-only access while withholding state-changing authority. The decision remains inspectable if a future release changes tools, prompts, model versions, data scope or approval logic.

Research basis and limits

In Verification of Adaptive Agentic Controllers through Finite Rule Revision (Garrone, 2026, preprint), a stylized controller is assessed using explicit rules, diagnostic predicates, candidate edits and held-out re-evaluation. This motivates separating the diagnosis of an unacceptable action from acceptance of a proposed repair. Its controlled inventory setting does not establish field reliability for a deployed language-model agent.

The European Commission Joint Research Centre reviews limitations of benchmark practices, including the limits of one-time and text-centric tests. ENISA offers complementary AI cybersecurity practices across infrastructure and AI-specific layers. Neither provides universal deployment thresholds for individual companies. Relevant legal requirements, including those under the EU AI Act where applicable, require a separate context-dependent assessment.

The practical decision

For a buyer or operator, the final question is not whether a pilot looks successful. It is which permission can be justified by the available evidence, what additional tests would change the answer, and which actions must remain prohibited. A transparent, permission-specific approval record makes the boundary between an encouraging experiment and an operational authorization explicit.

For the separate design of acceptance tests, see our pre-deployment testing guide and Agentic AI Evaluation Protocol. For an independent review service, see AI Agent Evaluation and Technical Resources.