Picture an accounts-payable agent that has spent three months in a pilot program, matching invoices to purchase orders and drafting approvals that analysts accept almost every time. The steering committee asks the natural next question: why not let it release the payments itself?

That is a production-authority decision, and most organizations make it by momentum, not by design. Many are already living with the consequences. A Cloud Security Alliance survey of 445 IT and security professionals found that 53% of organizations had seen agents exceed their intended permissions. An IBM study of 2,000 technology executives found that two-thirds of surveyed CIOs and CTOs were accountable for AI systems they could not fully control.

Chief data officers (CDOs) sit closest to the raw material of this decision: data lineage, access records, evidence, and a history of what the system actually did. After building data and AI functions in banking, financial services, insurance, consumer goods, and enterprise technology, I organize the decision into five gates: questions to answer before an agent is given real authority and to reopen whenever the model, data, tools, market or decision rights change.

Production Authority Is a Ladder, Not a Switch

An agent can advise while a person decides, prepare an action that a person confirms, or act within defined limits and escalate exceptions. Each rung demands more of every gate, as the figure below shows. The gates are the requirements an agent has to clear; the ladder represents the level of authority it earns after clearing them. An agent that can’t yet clear a gate isn’t a failed project; it just stays on a lower rung until it’s ready to climb further.

Gate 1: Data Foundation 

The ask is decision-grade data, not a perfect enterprise estate, which does not exist. It’s whether the data is fit for the consequence of the decision it feeds. Before authority is granted, leaders need clear answers:

• Where did each input originate?
• Does its quality suit the risk of the decision?
• What happens when two systems disagree?

An agent that cannot resolve a conflict deterministically should escalate instead of quietly picking a winner.

While leading data efforts for a global insurer across regions, I found that the foundation hadn’t kept pace with what the business needed. Aligning business CxOs on foundation-first, my team and I paused roughly 80% of planned delivery for eight weeks to rebuild it, and incidents fell by about three-quarters.

Gate 2: Access and Reasoning 

Permissions control what an agent can reach, not what it may learn to optimize for. The harder decision this gate forces is whether its incentives can be trusted with that reach, not just whether the access itself looks safe. Suppose the accounts-payable agent is scored on invoices cleared per hour. It never exceeds a permission, yet it drifts toward the fastest path, including borderline invoices. No access control fires because nothing was breached. This is reward hacking, and it’s not only a model-risk issue but also a governance failure.

The safeguards are organizational as much as technical: counter-metrics that balance the objective, independent challenge, and adversarial tests of the whole workflow, including indirect prompt injection. A related risk is aggregate authority: individually reasonable permissions or a chain of tool calls across agents that compose into more reach than any single grant intended. Picture one agent with read-only access to customer records and a second with permission to send external emails — neither is risky alone, but a chain connecting them could quietly leak customer data at scale. Tracing delegation has to cover both.

Gate 3: Regulatory Readiness

Regulatory readiness has three parts:

• The clock answers “when”: The timing isn’t just a fixed date. Triggers can move it even when nothing in the system changes. A rule’s effective date, a change in intended use, or a regulator’s amendment can reopen a question you’d already closed.
• The scope answers “what”: Which obligations apply depends on the use case, the markets you operate in, and where the organization sits in the AI value chain. That boundary shifts when decision support quietly becomes the decision.
• The proof answers “how”: A contemporaneous record of risk assessments, decision logs, and what changed, when, and who decided.

A fraud-detection agent tuned for one market, for instance, can silently fall out of scope the moment it’s extended into a new jurisdiction, with no code change at all.

Europe’s move to defer its high-risk AI obligations to December 2027 shows that deadlines move. The expectation that you can explain a consequential decision does not.

Gate 4: Unit Economics 

A pilot proves feasibility. The decision to move an agent into production must demonstrate value at a sustainable cost, and the number that matters is the fully loaded cost of one completed, quality-accepted outcome. Model calls are only the visible part; retrieval, orchestration, guardrails, human review, and exception handling belong in the figure too.

IBM projects AI reaching nearly 25% of IT budgets by 2027, yet 85% of executives lack full visibility into that spend in real time. Organizations with strong financial discipline deploy 2.4 times more agents at no higher cost.

Measure three numbers before an agent scales: its unit cost, how that cost behaves as volume and complexity grow, and realized value against the original business case. I have delivered about 2x ROI on a $33 million global portfolio within 5% of budget and cut analytics cloud costs by more than 80% for more than 160 teams. The lesson was the same both times: consumption-priced systems drift away from value when nobody owns the unit cost. Build the cost model when the idea is proposed.

Gate 5: Accountability 

Accountability is agreement, reached before launch, on who owns the business use case, who owns the AI system, and which operational supervisor has the authority to pause it. Naming roles is only half the work. The harder and more easily skipped half is defining when a human actually has to step in and then rehearsing it, as the figure below spells out. For example, an organization could pause a claims agent the moment a payout crosses a threshold nobody pre-approved and route it to a human reviewer before it proceeds. The gap is real: only 15% of respondents in the same CSA survey said most of their agents had a defined owner.

What the CDO Owns

Production authority is conditional, not a one-time approval. Controls need to be designed early, tested before deployment, and reassessed as the model, data, or context changes. The CDO’s role is to make that discipline repeatable: a governed inventory of material agents and a single decision record for each showing the data, authority, obligations, economics, and intervention model behind its place on the ladder.

Not every agent will clear every gate, and most do not need to on day one. An agent that advises is already valuable. Capability gets an agent into the pilot. Evidence earns it production authority.

Author’s note: This article reflects the author’s practitioner experience. It is not legal advice and does not replace jurisdiction-specific regulatory, security, privacy, or risk review.