Welcome to Khan's Blog

Yesterday I made the case that AI agents need job descriptions — a defined role, authority limits, escalation triggers, an audit trail. Several of you asked where to start. Start here, with five questions. Not about the technology. About the accountability around it.

In this series I’ve always framed the questions the same way: where you are today, and where you should be tomorrow. Agents are no exception.

1. Who — Who is responsible when an agent makes a decision? Today, the answer in most organizations is a shrug, or “the team.” Tomorrow, every agent has a named human owner — someone whose name is on the audit log, who approves scope changes, and who gets the call at 2 AM. Accountability that belongs to everyone belongs to no one.

2. What — What actions can your agents take right now? Today, most leaders can’t produce a complete list. Tomorrow, every agent operates from a written scope: what it may do alone, what needs approval, and what is forbidden entirely. If you can’t enumerate an agent’s powers, you haven’t granted them — you’ve leaked them.

3. Where — Where do agents touch your data and systems? Today, agents accumulate access the way closets accumulate boxes. Tomorrow, every integration is mapped, every data store is classified, and sensitive systems are off-limits by default. An agent should have to earn its way into your crown jewels, not inherit the keys.

4. When — When does an agent escalate to a human? Today, escalation is whatever the vendor set as a default. Tomorrow, you define the triggers: dollar thresholds, confidence floors, novel situations, conflicting instructions — and a rule that silence is never consent. Autonomy should expand on your schedule, not the agent’s.

5. Why — Why was each agent deployed, and why does it still have its access? Today, agents are deployed for a pilot and forgotten. Tomorrow, every agent’s access has an expiration date and a reason that gets re-examined. The most dangerous agent in your organization isn’t the one that misbehaves — it’s the one nobody remembers authorizing.

Ask these five questions in your next leadership meeting. If the room goes quiet, you have your answer — and your starting point.

When a new employee joins your organization, nobody just hands them a laptop and says “go figure it out.” They get a job description — what they’re responsible for, what decisions they can make on their own, what needs approval, who they report to. We invented all of that because we learned the hard way what happens when authority is ambiguous.

So why are we onboarding AI agents with none of it?

Agents aren’t chatbots anymore. A chatbot answers a question. An agent does something — books the flight, approves the expense, messages the customer, moves the data. The moment a system can act, it has crossed from tool to worker. And yet we govern it like a tool: deployed with default permissions, no defined role, no supervisor, no audit trail anyone reads until something breaks.

An agent job description has six parts. Same machinery we already use for every junior hire:

This isn’t abstract. Here’s what one actually looks like — a travel booking agent, the kind any consulting firm or government contractor could deploy tomorrow:

Position: Travel Booking Agent (AI) — reports to the Office Manager (human).

Role. Book domestic travel: search flights, hotels, and rental cars; hold or purchase reservations; track confirmations and receipts; flag itinerary changes. It executes bookings — it does not set travel policy or approve exceptions to it.

Authority limits. May purchase economy airfare and standard hotel rooms up to $1,500 per trip leg, only on the approved vendor list. May hold (not purchase) above that for 48 hours pending review. May touch only the booking tools and the corporate card profile — never personal card data, HR records, or client files. May not email travelers’ personal addresses or modify a booking once a human has confirmed it.

Escalation triggers. The agent stops and routes to the manager when: the cheapest compliant option exceeds its limits; the traveler is a minor; a flight is cancelled, delayed 4+ hours, or rebooked to another airline; firm policy and the traveler conflict; or the same booking fails twice — no third attempt without a human. And silence is not consent: no response within 24 hours of a hold confirmation, and the agent releases the hold instead of purchasing.

Audit trail. Every action logged — timestamp, traveler, vendor, amount, policy rule applied, approval state. Immutable, retained three years, reviewed monthly. Any escalated action carries the approving human’s name.

Performance review. Quarterly: on-time booking rate, policy compliance, escalation accuracy — did it escalate the right things, not everything. Two bad quarters and it’s demoted to holds-only until retrained.

Offboarding. Credentials revoked on retirement, pending work handed over with a full log, the owner signs off that nothing is left running unattended.

Notice: nothing in there is exotic. It’s what we already do for a junior hire — define the job, cap the authority, say when to ask for help, keep receipts, know how to fire them. The only novelty is doing it for software that works at machine speed and never sleeps.

Ask yourself the three questions about any agent running in your organization today:

If you can’t answer all three, your agent doesn’t have a job description. It has a hall pass.

Government agencies have written position descriptions and delegations of authority for decades — the exact machinery agents now need. The organizations that get agentic AI right won’t be the ones with the best models. They’ll be the ones that treat agents like employees from day one. The rest will discover, one incident at a time, that an unmanaged agent is just an employee you can’t fire — because you never hired it properly in the first place.

Your organization has an org chart. Does your agent have a place on it?