Who Signs When the AI Agent Decides — and Acts?
Introducing the AI-Human Accountability Pattern — three phases for understanding where AI autonomy ends and human responsibility begins.
Introducing the AI-Human Accountability Pattern — three phases for understanding where AI autonomy ends and human responsibility begins.
A question that just became urgent
On June 17, 2026, at the AWS Summit New York, AWS announced something that should have made every enterprise architect stop and think.
Their AWS DevOps Agent now offers release management in preview — it can evaluate code changes for production readiness autonomously. It assesses risk, runs change-specific tests in production-like environments, and returns a verdict: BLOCK, Proceed with Caution, or Safe to Release. Without a human reviewer in the loop.
On the surface, that sounds like a productivity win. And it is — technically.
But it surfaces a problem that most organisations have not yet answered: when an AI agent is the one making the deployment decision, who is accountable for what happens next?
The answer isn't in the AI model. It isn't in the AWS documentation. It's in your governance structure — and for most enterprises, that structure was designed entirely around the assumption that a human would sign off.
That assumption just expired.
The accountability gap nobody has named yet
Most enterprise frameworks for AI adoption describe capability maturity. They tell you what the AI can do at each stage. Bensing & Edwards (Beyond the IDE, IT Revolution, 2026) introduce the EVO phases — Exploration, Validation, Operation — as a graduated model for taking systems from idea to production. In Exploration, AI is a creative accelerant and the creator bears all risk. In Validation, AI shifts to risk identification. In Operation, their term for it is stark: AI becomes a "volatility multiplier."
These are useful. But they describe AI capability levels — not what happens to human accountability as those capabilities expand.
That's the gap.
Because the real question isn't "what can the AI do now?" The real question is: at each stage of AI adoption, what is the human still responsible for — and does your organisation know the answer?
The pattern I want to describe here answers that question directly. I'm calling it the AI-Human Accountability Pattern.
Introducing the AI-Human Accountability Pattern
The AI-Human Accountability Pattern maps AI adoption through three phases. What makes it different from existing frameworks is the verb pairing at each stage: it names not just what the AI does, but what the human's residual role is.
Here's the core:
| Phase | AI Role | Human Role |
|---|---|---|
| Phase 1 | Suggests | Does |
| Phase 2 | Assists | Decides |
| Phase 3 | Decides | Audits |
Simple. But the implications of each transition are significant.
Phase 1: AI Suggests, Humans Do
In Phase 1, the AI generates an output — a code snippet, a draft release note, a risk summary — but the human still executes the work themselves. The AI is a reference, a prompt, a starting point. The human remains both the decision-maker and the actor.
Accountability is clean here. Whatever happens, the human did it. The AI suggested; the human acted.
Most organisations are comfortable in Phase 1 because the governance question is easy. The human is clearly in the chain. If something goes wrong, there is an obvious place to look.
DevOps example: An AI coding assistant suggests a code block. The developer reviews it, modifies it, writes the pull request, and merges. The human's fingerprints are on the outcome.
AAO™ example: A customer asks their AI assistant "which restaurant should I try near the office?" The agent searches, reads reviews, and suggests three options with reasons. The customer picks one and calls to book. The agent suggested; the human acted.
Phase 2: AI Assists, Humans Decide
In Phase 2, the AI becomes a participant in the workflow, not just a reference. It drafts the release notes, runs the risk assessment, flags the deployment window. But the human still approves. The human still clicks the button.
This is where most mature organisations sit today, and where most change governance frameworks are designed to operate. ITIL change management, change advisory boards, deployment approval processes — all of these are built for Phase 2. A named human reviews, a named human approves.
Accountability is manageable in Phase 2, but it's already getting complicated. When the AI flags a deployment as low-risk and the human approves on that basis, and it turns out to be very high-risk — what does the postmortem say? "Human approved" is technically accurate. But everyone in the room knows the AI assessment influenced the decision.
Phase 2 accountability is shared in practice even when the governance says it's singular.
DevOps example: An AI DevOps tool analyses a pull request, flags a cross-repository dependency risk, and surfaces a caution recommendation with supporting evidence. The release engineer reads the report, reviews the affected services, and clicks approve. The human decided; the AI informed.
AAO™ example: A customer's AI assistant searches for restaurant availability, pre-fills the booking form with four guests at 12:30, and presents it for review. The customer checks the details and taps "Confirm." The agent assembled; the human decided.
Phase 3: AI Decides, Humans Audit
Phase 3 is where the AWS announcement lives. The agent doesn't just assess — it gates. It doesn't just recommend — it decides. Production goes or doesn't go based on what the agent concludes.
The human's role has shifted from decision-maker to auditor. After the fact. In the log.
This is where existing governance structures break.
Your change management process was designed to name a human accountable for each deployment decision. In Phase 3, the signer is an agent. The "authorised by" field in your change record now points to a confidence score, not a person.
Who do you call at 2am when the agent approved a bad release? Who answers to the auditor when the CAB equivalent is an AI? What does your SOX or ISO 27001 evidence look like when the approval chain runs through an autonomous system?
Most organisations do not have answers to these questions. And most cloud providers are not waiting for them to catch up.
DevOps example: An AI DevOps agent evaluates a PR, detects a critical access control violation against your production standards, and blocks the merge automatically. No human was consulted. The developer reads the structured report after the fact and addresses the issue. The agent decided; the human audited.
AAO™ example: A customer's AI assistant books the restaurant end-to-end — checks availability via the venue's API, processes payment through a tokenised wallet, and sends a confirmation to the customer's calendar. The customer reviews what happened. The agent decided and transacted; the human audited the outcome. This is what it means to be AAO™-ready.
Why the verb pairing matters
Other AI maturity models describe what the AI can do. The AI-Human Accountability Pattern describes what the human must still do.
That distinction sounds subtle. It isn't.
When you frame adoption by AI capability, you make a technology decision: is our AI ready for this? When you frame it by human accountability, you make a governance decision: are we ready for this? Do we have a named owner for each phase? Has that person or team accepted what their role now requires?
Each phase demands something different from the humans left in the chain:
- Phase 1 requires a skilled operator — someone who can evaluate AI output and execute correctly.
- Phase 2 requires a decision-maker — someone who understands AI assessment well enough to approve or reject it intelligently, not just rubber-stamp it.
- Phase 3 requires an audit function — a team, a process, and tooling that can verify what the agent decided, investigate when it got it wrong, and override it when necessary.
Each transition isn't just a capability upgrade. It's a redistribution of accountability — and if you don't redesign governance to match, you don't actually move phases. You just accumulate risk.
Phase 3 in practice: what AAO™ tells us
Here's where this gets concrete.
In August 2025, I published the original Actionable Agent Optimisation (AAO™) framework — the idea that businesses need to redesign their systems to be executable by AI agents, not just readable by humans. The six-layer IIWTMA stack (Identity, Inbox, Wallet, Tools, Memory, Audit) describes what it takes for an agent to interact with your business end-to-end.
The final layer — Audit — is Phase 3 accountability in operational form.
When an AI agent books a table, places an order, or authorises a payment on a customer's behalf, the agent decided to complete that transaction. The human's role shifted from actor to auditor — reviewing what happened, trusting the structured confirmation, and intervening only when something went wrong.
What AAO™ shows us is that Phase 3 readiness isn't just an internal governance question. It's an infrastructure question. Businesses that want to participate in an agentic economy need to receive the agent's action, confirm it completed, and return that confirmation in a machine-readable way — because the human who would previously have clicked "confirm" isn't there anymore.
The Audit layer of AAO™ isn't an afterthought. It's the accountability contract between the agent and the system it's transacting with. Without it, the agent operates on guesswork. With it, there's a clean, verifiable chain.
This is what Phase 3 governance looks like when you build for it deliberately, rather than stumbling into it.
Where most enterprises are right now
The honest picture: most enterprises are somewhere in Phase 1 or Phase 2 — and they are not all in the same place.
Organisations still in the early stages of AI adoption — experimenting with tools, running pilots, figuring out what "AI strategy" means for them — are predominantly in Phase 1. AI is a productivity aid, not a workflow participant.
The more mature enterprises — those with AI tooling embedded in their delivery pipelines, their operations, their customer workflows — have reached Phase 2. They have governance built around human approval. They have named decision-makers. They have, at least in principle, a chain.
Both groups are now being handed Phase 3 capabilities by their cloud vendors:
- AI agents gating production deployments autonomously
- Autonomous code review tools generating and running change-specific test plans
- AI-powered platforms operating customer-facing workflows end-to-end
These capabilities are available today, to organisations whose governance frameworks were built for earlier phases.
The typical response is to adopt the feature but neuter it: use the AI's risk assessment as a report, keep the human approval step, don't actually let the agent gate. That's safe. But it misses the compounding value entirely — and it defers the governance conversation rather than having it.
The organisations that will build durable advantage are the ones that explicitly name the transition: "We are moving from Phase 2 to Phase 3 for this workflow. Here is what our audit function looks like. Here is who is accountable for the agent's decisions. Here is how we investigate when it gets it wrong."
That's a governance conversation, not an engineering one. It needs to happen at the architecture level, before the feature is turned on — not after the first bad deployment.
The line you need to draw
Every AI adoption decision is implicitly a decision about where the AI-Human Accountability Pattern sits for your organisation.
Phase 1 → Phase 2: you let the AI into the workflow. You need decision-makers who understand AI output well enough to own the approval — not just trust it because it was confident.
Phase 2 → Phase 3: you let the AI own the outcome. You need an audit function — people, process, tooling — that can verify, investigate, and override.
Neither transition is inherently wrong. Both are necessary over time. But they require different things from the organisation — and most enterprises are making the transition without realising it, because a cloud vendor updated their platform overnight.
The AI-Human Accountability Pattern isn't an argument against AI autonomy. It's an argument for knowing which phase you're in — and designing your governance to match.
Your change management process was designed to give a human somewhere to sign. What does it look like when the signer is an agent — and the agent's confidence score is the audit trail?
That's the question. The smart organisations answer it before they turn the feature on.
References & Credits
- AWS DevOps Agent adds release management capabilities to assess code changes before production (preview) — Esra Kayabali, AWS News Blog, 17 June 2026.
aws.amazon.com/blogs/aws/aws-devops-agent-adds-release-management-capabilities… - "Beyond the IDE: Governing the AI-Accelerated Enterprise Without Slowing It Down" — Bill Bensing & Damon Edwards (Attestify), IT Revolution, Spring 2026. Enterprise Technology Leadership Journal, Vol. 3, Issue 1.
itrevolution.com/product/beyond-the-ide - Actionable Agent Optimisation (AAO™) — BMK Lakshminarayanan, first published 12 August 2025.
bmk.nz/blog/aao-part-2-the-agentic-internet-arrived
The AI-Human Accountability Pattern is an original framework by BMK Lakshminarayanan, June 2026. Phase 1: AI suggests, humans do. Phase 2: AI assists, humans decide. Phase 3: AI decides, humans audit.