AI Delegation Registers Are Becoming The Operating Manual For Business Agents

Agentic Business Design

16 August 2026 | By Ashley Marshall

AI agents do not just need prompts and permissions. They need a live register of what the business has actually delegated to them.

The missing control is not another policy document

Most AI governance work still starts with the wrong artefact. A business writes an acceptable use policy, publishes guidance on prompt safety, and then assumes the hard part is finished. That works while teams are experimenting with chatbots. It stops working when an agent can read a ticket, open a CRM record, draft a response, update a field, trigger a refund workflow, or ask another tool to complete a task.

The useful question is no longer just whether people are allowed to use AI. It is what authority has been delegated to each agent, who approved that delegation, what limits apply, and how the organisation will prove afterwards that the agent stayed within scope. That is the job of an AI delegation register. It should sit beside access reviews, change logs and risk registers, but it is not identical to any of them. It records delegated business authority in plain operational terms.

The National Cyber Security Centre has been unusually direct on this point. In its June 2026 guidance on agentic AI, the NCSC warned that agentic systems can access data, remember context, make decisions, use tools and take actions without continuous human intervention. It also said organisations should start small, use agents for low-risk tasks, and apply established cyber security controls from the outset. See the NCSC guidance: Thinking carefully before adopting agentic AI.

What this means in practice is simple. If an agent can act, the business needs a record of the authority behind that action. Without it, every incident investigation starts with the same uncomfortable question: who exactly allowed this system to do that?

A delegation register turns autonomy into accountable scope

A delegation register should not be a theoretical AI inventory. It needs to be specific enough that a service owner, compliance lead, operations manager and engineer can all read the same entry and understand what is allowed. A useful entry names the agent, its business owner, its technical owner, the workflow it supports, the systems it can access, the data classes it can process, the tools it can call, the actions it can complete without review, and the actions that require human approval.

That sounds administrative, but it changes the quality of control. Instead of saying that an AI assistant has CRM access, the register can say it may summarise contact history, draft follow-up notes, and propose next actions, but it may not change lead stage, alter a contract value, send a message externally, or delete records. Instead of saying that an operations agent supports finance queries, it can say it may retrieve invoice status and draft a response, but cannot approve a refund or update bank details.

This is where many pilots drift. A tool is initially connected to one system for convenience. Then another team asks for a small extension. Then the agent starts to handle edge cases. Nobody believes they have created a high-risk workflow, because each individual change feels modest. The register gives the business a place to see accumulated authority before it becomes invisible.

The counterargument is that registers slow teams down. In reality, the opposite is usually true once AI moves into live work. A pre-agreed record lets teams approve safe expansions faster because they can compare the requested capability with the existing scope, risk rating and evidence requirements. The register becomes a route to faster scaling, not just a compliance artefact.

The UK context is making evidence more valuable

UK organisations are not waiting for one single AI regulator to tell them how to operate. The UK approach remains largely principles-based and sector-led, but that does not mean light-touch in practice. The pressure is moving towards evidence: show that you understand the risk, show that the right person owns the outcome, show that decisions can be explained, and show that controls work under real conditions.

The Government's July 2026 Financial Services AI Adoption Plan shows the direction of travel. It reported that 21% of financial and real estate firms had already adopted AI in the DSIT AI Adoption Survey from early 2025, compared with 16% across the economy. It also noted FCA and Bank of England survey findings that AI adoption among surveyed financial services firms was around 75%. The same plan calls out the need for practical regulatory clarity, model risk management, explainability and accountability. Source: Financial Services AI Adoption Plan.

Those figures matter outside finance too. They show that the adoption curve has moved beyond isolated pilots in at least one heavily regulated sector. When adoption becomes normal, evidence becomes operational infrastructure. A business cannot rely on memory, Slack messages or old project decks to explain why an agent had authority to make a customer-impacting change.

A delegation register gives leaders a repeatable way to answer practical governance questions. Which agents can affect customers? Which can create financial commitments? Which process personal data? Which are limited to read-only work? Which have been reviewed since the last model or tool update? Those are the questions boards, insurers, auditors and customers will increasingly ask.

Human oversight has to be designed before the incident

Human-in-the-loop is often used as a comfort phrase, but it is only meaningful when the human can genuinely change the outcome. That matters for data protection, consumer outcomes and operational resilience. If a person is asked to approve an agent's action after the system has already updated the record, sent the message or triggered the downstream process, the business may have supervision theatre rather than supervision.

The Information Commissioner's Office consultation on updated automated decision-making guidance, opened after the Data (Use and Access) Act 2025 changes, is a useful signal for any UK organisation using AI in workflows that affect individuals. The ICO consultation says the updated guidance is aimed at data protection officers, compliance professionals and technical leads with oversight of an organisation's use or procurement of automated decision-making systems. See the ICO page: ICO consultation on automated decision-making.

Legal commentary on the draft guidance has also highlighted a practical point: human involvement needs to happen while the decision can still be changed, and the reviewer must understand the system's logic, outputs, limitations and risks. That is not something a team can bolt on after deployment if the workflow was designed around automatic execution from the start.

What this means in practice is that the delegation register should specify the review point, not just the reviewer. For example, an agent may draft a pricing exception, but a sales manager must approve before the offer is issued. An agent may identify suspected fraud, but a trained analyst must review before service is restricted. An agent may recommend a supplier risk rating, but procurement retains the final decision before onboarding continues.

Cyber risk increases when agents inherit broad access

The security case for delegation registers is just as strong as the governance case. Agentic systems widen the attack surface because they connect models to tools, memory, external data and business systems. That turns a prompt injection or compromised data source into something more serious than a strange answer in a chat window. It can become an unauthorised action in a live workflow.

The joint guidance on careful adoption of agentic AI services, co-authored by cyber agencies including the UK NCSC, CISA, NSA, the Canadian Centre for Cyber Security and others, recommends aligning agentic AI risks with the organisation's existing security model and risk posture. It also says organisations should never grant broad or unrestricted access, especially to sensitive data or critical systems, and should only use agentic AI for low-risk and non-sensitive tasks. The guidance is available here: Careful adoption of agentic AI services.

A delegation register helps translate that advice into access control decisions. If an agent's registered authority is read-only customer service support, it should not have credentials that allow record deletion, refund approval or outbound email from a shared mailbox. If its authority is limited to UK customer data, it should not be routed through a tool chain that sends sensitive context to an unapproved environment. If it can call APIs, each API action should map back to the registered purpose.

The common misconception is that identity and access management already solves this. It solves part of it, but it does not capture business delegation. A user account or service account can tell you what a system is technically able to do. The register tells you what the organisation intended it to do, why, under whose authority and with which review conditions.

Start with a small register and make expansion deliberate

The best first version of an AI delegation register is deliberately boring. Start with the agents already touching live or near-live workflows. For each one, record the business purpose, owner, systems connected, data processed, actions allowed, actions blocked, human review points, evidence retained, incident route, review date and expansion criteria. If the team cannot complete those fields, the agent is probably not ready for broader deployment.

Do not try to make the register a perfect enterprise catalogue on day one. The useful move is to connect it to decisions the business is already making. When an agent asks for a new tool permission, update the register. When a workflow moves from pilot to production, update the register. When a model changes, record whether the delegated authority still applies. When an incident or near miss happens, update the risk notes and limits.

This also gives senior leaders a clearer way to govern AI without getting pulled into every technical detail. A monthly review can focus on a few concrete questions. Which agents gained new authority? Which agents can affect customers, money or regulated outcomes? Which controls failed or needed manual intervention? Which agents should be retired because a simpler automation would be safer? Which approvals are being rubber-stamped instead of genuinely reviewed?

For many UK businesses, the next stage of AI maturity will not be won by adding more models. It will be won by knowing exactly where autonomous work has been delegated, keeping that delegation narrow, and expanding it only when the evidence justifies the next step. The delegation register is not glamorous, but it is the kind of operational discipline that lets useful agents survive contact with real business risk.

Frequently Asked Questions

What is an AI delegation register?

It is a live operational record of what authority the business has delegated to each AI agent, including allowed actions, blocked actions, system access, ownership, review points and evidence requirements.

Is this different from an AI inventory?

Yes. An AI inventory lists systems. A delegation register records the business authority attached to those systems, especially where agents can act in workflows rather than only produce content.

Who should own the register?

The business owner of each workflow should own the delegation entry, with input from security, data protection, compliance and technical owners. Central governance can maintain the format, but ownership should stay close to the workflow.

Which agents need to be included first?

Start with agents that can access live systems, process personal data, affect customers, create financial commitments, send messages externally, update records or trigger downstream workflow actions.

Does a delegation register slow AI adoption?

It can slow careless expansion, which is the point. In mature teams it usually speeds adoption because leaders can approve bounded changes faster when authority, limits and evidence are already clear.

How often should entries be reviewed?

Review entries at least quarterly for live agents, and immediately after material changes such as new tools, new data sources, model upgrades, workflow expansion, incidents or near misses.

What evidence should the register point to?

It should point to approval records, access reviews, test results, evaluation logs, incident routes, human review records and any monitoring dashboard used to confirm that the agent is staying within scope.

Can smaller businesses use a simple spreadsheet?

Yes. A spreadsheet is often enough at the start if it is kept current, owned by named people and used in permission decisions. The discipline matters more than the tool.