The short version
We build our delivery model around AI agents, so a memo on when not to use them may look odd. We think it is the most useful thing a delivery leader can read before buying any agent-based service, ours included. An agent is a tool with a particular failure profile. It is fast, tireless and often right, and it can also be confidently wrong without any signal that it is. The decision is not "agents or people". It is which steps in a piece of work can tolerate that failure profile, and which cannot.
This memo gives three tests, a decision table, and a plain list of what we will not hand to an agent.
What the official guidance says
In May 2026 the Australian Signals Directorate's Australian Cyber Security Centre, with partner agencies from the United States, Canada, New Zealand and the United Kingdom, published joint guidance titled "Careful adoption of agentic AI services". As reported by New Zealand's NCSC and A&O Shearman, it advises organisations to:
- fold agentic risk into their existing security posture rather than treat it as a separate problem;
- apply least privilege, so an agent holds only the access its task needs;
- put human-in-the-loop checkpoints at the points that matter;
- favour reversibility and limit the blast radius of any single action; and
- confine agents to low-risk, non-sensitive tasks until an organisation's practices mature.
We have read these through secondary reports and we recommend you read the guidance itself. The direction is clear enough to build a decision process on, and that is how we use it below.
Three tests before handing a task to an agent
1. Does the task need human judgement?
Some work is not a matter of producing an answer but of weighing competing interests and owning the result. Deciding whether a person gets a service, whether a contract term is acceptable, or whether a risk is tolerable are judgements. An agent can prepare the material, list the options and flag inconsistencies. It should not be the one who decides, because accountability cannot be delegated to software. Someone has to be able to say "I decided this, and here is why".
2. Is the information sensitive?
Personal information, security-classified material and commercially sensitive data raise the cost of every mistake: a leak, a wrong inference, or data sent somewhere it should not go. The Office of the Australian Information Commissioner has advised, as summarised by the Future of Privacy Forum, that the Privacy Act applies to personal information put into AI tools and produced by them, and that personal information, especially sensitive information, should not be entered into public generative AI tools. If you cannot say where the data goes, who can see it and how long it is kept, the task is not ready for an agent.
3. Can the action be undone?
Drafting a document is reversible: you read it, you change it, you discard it. Sending an email to a customer, changing a production system, moving money or deleting records is not. The more irreversible the action, the stronger the case for a person to perform it, or at minimum to approve it immediately before it happens. Where a task cannot be made reversible, shrink what it can touch.
Decision table
| Situation | Agent alone | Agent with human review | Person leads |
|---|---|---|---|
| Summarising public documents, drafting first versions, producing test cases | Reasonable, with spot checks | Preferred for anything leaving the team | Not needed |
| Code changes in a non-production branch with tests | Reasonable to attempt | Review before merge | Not needed |
| Analysis of non-sensitive internal data | Possible | Review the method and the result | Where findings drive a major decision |
| Anything touching personal or sensitive information | No | Only if scoped, approved and reviewed | Default |
| Communication with customers or the public | No | Draft only, a named person sends | Default for difficult cases |
| Changes to production systems | No | Only with a reviewed, reversible change | Default |
| Decisions about individuals (hiring, eligibility, performance, discipline) | No | No, agents may only collate facts | Always |
| Final legal, financial or regulatory sign-off | No | No, agents may prepare drafts | Always |
Read the table as a default, not a rule engine. Your risk appetite, your regulator and your data classification may move a row.
What we will not hand to an agent
These are our standing limits. They do not depend on the engagement.
- Decisions about people. Agents do not decide hiring, eligibility, performance, discipline or entitlement outcomes.
- Final legal, financial or regulatory sign-off. Agents may draft and check. A qualified person signs.
- Unreviewed production changes. No agent changes a production system without human review of the change.
- Sensitive or personal information, unless scoped and approved. We use it only where the scope has been agreed with you and approved in writing in advance, and not otherwise.
- Unsupervised customer communication. Nothing an agent writes goes to your customers or the public without a named person reading and sending it.
Behind these limits sits a structural rule: every engagement has a named human lead who is accountable for the work, and every deliverable discloses where AI agents were used. If an agent has touched something, you can see that it has.
Where agents do earn their place
None of this means agents are useless. Work that is high in volume, bounded in scope, checkable and reversible is where they help most: first drafts, test generation, code reading and documentation, comparison of documents, and structured analysis of non-sensitive material. The pattern we use is that agents do the work and a named person signs it off. Review effort is real, and we price it into the work rather than pretending it is free.
A practical way to apply this
- List the steps in the work, not the work as a whole. Most projects contain steps in every row of the table above.
- Mark each step for judgement, sensitivity and reversibility.
- Assign each step to agent alone, agent with review, or person.
- Name the person accountable for each review point.
- Agree what is out of scope for agents before work begins, and write it down.
If a vendor cannot walk you through that exercise for your own work, treat that as information.
How this article was written
Drafted with AI agents and reviewed by xShopper. Facts are linked to their sources; anything we could not confirm at a primary source is marked as such.