Agentic Automation and Internal Controls

1. Research problem

Which automated decisions require mandatory human authorisation? The project would examine this question within artificial intelligence, where institutional arrangements, measurable outcomes and the costs of implementation may point in different directions. It is designed as a falsifiable research programme rather than a claim that the proposed mechanism has already been demonstrated.

2. Working proposition

Risk-tiered approval gates can preserve autonomy in low-risk tasks and oversight for irreversible actions. This is a testable proposition, not an established result. Competing explanations and contexts in which the mechanism fails should be specified before data collection begins.

3. Research theses for examination

1. Mechanism: Risk-tiered approval gates can preserve autonomy in low-risk tasks and oversight for irreversible actions.
2. Boundary conditions: Assess whether the proposition remains plausible when jurisdiction, organisational maturity, resource constraints or stakeholder interests change.
3. Disconfirmation: Record which observations would favour an alternative explanation or show that the proposed approach adds no meaningful value.

4. Research design and methods

Analyse process maps and run failure-mode simulations with audit logging. The initial protocol should establish sampling criteria, the unit of analysis, definitions of variables or legal concepts, a transparent source register, and access and ethics approvals where necessary.

5. Evidence horizon and relevant developments

NIST’s Generative AI Profile provides a voluntary risk-management reference. It addresses trustworthiness considerations in developing, deploying and evaluating generative systems rather than certifying specific products.

The OECD’s 2025 Corporate Governance Factbook compares frameworks across 52 economies and documents changes in ownership, board composition and sustainability disclosure. Formal requirements must be distinguished from company-level practice.

The cited publications provide current institutional context and candidate sources for the literature review. They do not certify the proposed hypothesis; original empirical work, careful comparison and jurisdiction-specific validation would still be required.

6. Planned work packages

1. Conceptual groundwork: Define the research object, terminology, competing frameworks and decision context.
2. Evidence mapping: Create an auditable inventory of relevant primary evidence, with dates, definitions, strengths and limitations.
3. Evaluation: Analyse process maps and run failure-mode simulations with audit logging; contrast results with alternative specifications, control cases or rival interpretations.
4. Critical review: Report missing observations, conflicting evidence, implementation costs and circumstances that limit transferability.
5. Translation into practice: Prepare the intended practical output and an independent review checklist.

7. Anticipated research product

Agentic automation control catalogue. The deliverable will be evaluated against the research question and the evidence collected.

8. Limitations, ethics and scholarly integrity

At this stage no original sample, statistical test, clinical cohort or experimental result is claimed. Any future research involving human participants, proprietary data, medical outcomes or regulated activities must obtain the applicable permissions. Publicly accessible official publications are cited for context only; their findings are not represented as findings of BBARTI.

9. Selected institutional reading

• NIST · Generative AI Profile, AI RMF 600-1 ↗26 July 2024
• OECD · Corporate Governance Factbook 2025 ↗6 October 2025