AI Agent Handover Protocols Need To Be Designed Before Delegation

Agentic Business Design

17 August 2026 | By Ashley Marshall

The risky moment is not when an agent writes. It is when a suggestion becomes a business action.

The handover is now the control point

AI agents are moving from helpful drafting tools into systems that can plan steps, call tools, retrieve data and take action. That change makes the handover between the agent and the human operator the most important design decision in the workflow. The National Cyber Security Centre says agentic systems can access data sources, remember context, make decisions, use tools and act in pursuit of a goal, sometimes without continuous human intervention. In the same guidance, the NCSC advises organisations to start small, use agents only for low-risk tasks and apply established cyber security controls from the outset. Source: NCSC guidance on agentic AI adoption.

For UK businesses, the practical implication is simple: do not treat human review as a vague promise. A handover protocol should say exactly when the agent must pause, what evidence it must present, who is allowed to approve the next step, and how that decision is recorded. That matters whether the agent is triaging sales leads, drafting refunds, reconciling invoices, preparing procurement notes or opening support tickets. The risky moment is rarely the text generation itself. It is the point where a suggested action becomes a business action.

The common misconception is that a human in the loop automatically solves the problem. It does not. If the human receives a rushed summary, cannot see the source data, lacks authority to stop the workflow or is asked to approve too many low-quality escalations, the control is cosmetic. A useful handover reduces ambiguity. It gives the human a decision packet, not a panic button.

Regulators are already treating agents as business actors

The Competition and Markets Authority has been direct about customer-facing AI agents. Its March 2026 guidance says the same consumer law rules apply whether customers interact with a person or an AI agent, and that businesses are responsible for what an AI agent does in the same way they are responsible for what an employee does. The CMA also warns that breaches of consumer protection law can lead to fines of up to 10% of worldwide turnover, with possible compensation for affected consumers. Source: CMA guidance on consumer law and AI agents.

This changes the internal conversation. A business cannot say the agent merely suggested something if the customer experience, refund decision or marketing claim was shaped by the system. If an AI agent tells a customer that they are not entitled to a refund, recommends a product without explaining limitations, or drafts a promotion that misses required pricing information, the firm owns the consequence. The handover protocol is therefore part of the compliance design, not just the operations design.

What this means in practice is that customer-facing agents need escalation rules tied to consumer rights. Refund requests, cancellation rights, vulnerable customer signals, unusual price claims, complaints, chargeback threats and high-value exceptions should not be handled as ordinary tickets. The agent should collect the facts, cite the applicable policy or legal basis, explain uncertainty and route the case to a named human role. That is slower than blind automation, but it is far faster than unpicking thousands of flawed decisions after the event.

A good handover packet beats a vague escalation

A handover protocol should be designed as a product feature. The agent should not simply say that it is unsure. It should pass a structured packet to the human reviewer: the user request, the business objective, the data sources consulted, the actions already taken, the proposed next action, the confidence level, the reason for escalation, the relevant policy, and the deadline. If the agent has interacted with third-party systems, the packet should include those tool calls and responses. If it has processed personal data, it should state which categories of data were used and why.

The CMA says businesses should monitor whether AI agents are delivering the right results, behaving as intended and complying with consumer law. It also says human oversight is important to catch mistakes and ensure agents complete tasks in a legally compliant way. A handover packet is how that oversight becomes operational. Without it, the reviewer is forced to reconstruct the case from logs, chat snippets and disconnected system records. That creates delay, missed risk and false confidence.

The leading counterargument is that this adds too much friction. In low-risk workflows, that may be true if every action requires approval. The answer is not to remove handovers. It is to tier them. Let the agent complete low-value, reversible actions inside strict bounds. Require review when the action is high impact, irreversible, legally sensitive, customer-facing, financially material or outside the agent defined scope. The point is proportional control. A procurement note and a purchase order should not have the same approval path. A draft response and a sent response should not be governed as if they carry the same risk.

Access boundaries must be linked to handover rules

The NCSC warning is especially relevant for agents connected to business systems. It says organisations should never grant an agent unrestricted access to sensitive data or critical systems, and should maintain ongoing visibility of the system operation. It also gives a plain test: if you cannot understand, monitor or contain an agent actions, it is not ready for deployment. That test should sit at the top of every agent design review.

In practice, handover protocols and access controls need to be designed together. If an agent can read a CRM but not update it, the handover point may be the first proposed field change. If it can draft a supplier email but not send it, the handover point is outbound communication. If it can prepare an invoice correction but not apply it, the handover point is the finance system update. Access should expand only when the handover evidence shows the agent is predictable, monitored and useful within the existing boundary.

This is also where temporary credentials and least privilege become business controls, not just security controls. Give the agent the minimum access required for a defined task, for the shortest practical period, and revoke elevated access when the task is complete. For repeated tasks, use scoped service accounts, approval gates and detailed audit logs. For unusual tasks, require a human to grant a short-lived permission. The aim is not to make agents timid. It is to make delegation legible. Leaders should be able to see where authority moved from human to machine, where it paused, and who approved the next step.

Data protection makes meaningful review more than a UX choice

The Information Commissioner Office said in May 2026 that it plans dedicated guidance on agentic AI as part of wider work to give businesses more certainty on how data protection law applies to AI development and deployment. Source: ICO response on safe AI-powered innovation. That matters because agentic workflows often combine personal data from multiple systems, make intermediate judgements and then act through tools that were designed for human users.

A handover protocol should therefore record more than the final recommendation. It should make the data journey visible enough for a reviewer to understand whether the agent used the right information for the stated purpose. If a sales agent enriches a prospect, if a customer service agent reads previous complaints, or if a HR assistant ranks candidates for follow-up, the reviewer needs to know what was used, what was ignored and what the agent inferred. Otherwise the firm cannot explain the decision with confidence.

What this means in practice is that agent handovers should include privacy checks for purpose limitation, special category data, automated decision-making risk and retention. The human reviewer should not need to be a lawyer, but they do need prompts that reveal the relevant issue. Did the agent rely on sensitive information? Did it make a decision that affects a person significantly? Is the proposed action based on stale or inferred data? Should the record be retained, redacted or deleted? These checks are easier to build before launch than after a complaint lands.

The operating model is the real differentiator

The strongest agent programmes will not be the ones with the most impressive demos. They will be the ones with the clearest operating model. The CMA research paper on agentic AI says agents may assess goals, break them into subtasks, retrieve real-time data, execute actions and store memory of past interactions. It also says the shift from using tools to delegating outcomes could materially change how people engage with markets, while creating risks around manipulation, loss of consumer agency, transparency, incentives and accountability. Source: CMA research on agentic AI and consumers.

That is why the operating model should answer five questions before deployment. Who owns the agent? What decisions can it make alone? What must it hand over? What evidence must it provide? Who can stop it? Those answers should be visible in the workflow, not buried in a policy document. If the agent serves customers, product, legal and operations need to agree the triggers. If it touches finance, finance must define the thresholds. If it touches personal data, the data protection owner must shape the review packet.

The business case for agents is still strong. They can remove queue time, join up fragmented work and let people focus on judgement rather than administration. But the winning pattern is bounded autonomy. Start with narrow tasks, design the handover, measure the quality of escalations, expand only where the evidence supports it, and keep a rollback path. Delegation should feel boring from a control perspective. The agent can be clever. The governance should be plain enough that a manager can explain it in one minute.

Frequently Asked Questions

What is an AI agent handover protocol?

It is the rule set that defines when an AI agent must pause, what evidence it must pass to a human, who can approve the next action and how the decision is recorded.

Is human in the loop enough for AI agents?

No. Human review only works when the reviewer has context, authority, time and a clear decision to make. A vague escalation is usually too weak.

Which agent actions should always be escalated?

Escalate irreversible actions, financial approvals, legal or consumer rights issues, customer complaints, vulnerable customer signals, unusual data use and anything outside the agent approved scope.

Can agents still act autonomously?

Yes, but autonomy should be bounded. Low-risk, reversible and well-tested tasks can run automatically while sensitive or high-impact actions require a structured handover.

Who should own an AI agent in a business?

A named business owner should own outcomes, access, monitoring and incident response. Technical teams can operate the system, but accountability should sit with the function that benefits from the agent.

How does this affect customer service agents?

Customer service agents need escalation rules for refunds, cancellation rights, complaints, inaccurate claims and vulnerable customers, because the business remains responsible for the agent behaviour.

What should be included in a handover packet?

Include the request, objective, sources, data used, actions taken, proposed action, confidence level, policy basis, escalation reason, deadline and audit trail.

How should a business start?

Start with one narrow workflow, define the boundaries, log every handover, review escalation quality weekly and expand only when the evidence shows the agent is reliable.