The question is almost never whether an AI agent can do the task. Ask a capable agent to reconcile last month's invoices, draft forty follow-up emails or pull the weekly traffic report, and it will produce something for all three. The real question is narrower and much more useful: what does it cost you to check the result, and what does it cost you to undo it when the result is wrong.
Which tasks should you hand to an AI agent?
Delegate a task to an AI agent when two things are true: checking the output costs less than doing the work yourself, and a wrong result can be undone cheaply. Tasks that are cheap to check and cheap to undo go first. Tasks that are expensive to check and expensive to undo stay with a person.
The delegation scorecard is a four-cell test that places a task by two costs: what it costs to check the AI agent's output, and what it costs to undo it.
| Cheap to undo | Expensive to undo | |
|---|---|---|
| Cheap to check | Delegate with write access. | Delegate draft-only: the AI agent finishes the work, a person commits it. |
| Expensive to check | Delegate, but reshape what the AI agent hands back so it can be checked at a glance. | Keep it with a person. |
Most published advice scores tasks on impact and effort instead. That pair tells you what is worth automating, not what is safe to automate, which is why teams pick the exciting task and get caught by what happens when the output is wrong and nobody notices.
What makes a task cheap or expensive to check?
Verification cost is what it takes you to establish that the AI agent's output is right. It is cheap when correctness is visible in the output itself, expensive when you have to redo part of the work to know.
Three pairs make it concrete. A reconciliation returning a difference figure is cheap: the number is either zero or it is not. A written summary of the same accounts is expensive: the only honest check is to read the accounts. A data pull that ships the source rows beside the answer is cheap; the answer alone is expensive. A report printing last week's figure next to this week's is cheap; the figure alone is expensive.
Verification cost is therefore set by the shape of the output, not by the task. Change what the AI agent hands back and the work moves from the expensive column into the cheap one, far cheaper than deciding not to delegate.
Checking is also measured at volume, not at pilot scale. Checking five outputs carefully is one job; checking two hundred is a different job, and the second is the one you signed up for.
Why do people stop checking AI output?
Because automation that works trains people to stop looking. That is not a character flaw; it has been studied for decades under the names automation complacency and automation bias.
Raja Parasuraman and Dietrich Manzey set out the integrated account in "Complacency and Bias in Human Use of Automation: An Attentional Integration" (Human Factors, 2010): complacency appears under multiple-task load, when manual tasks compete with the automated one for attention, and automation bias produces both omission and commission errors when the aid is imperfect. Their review finds both effects in novices and experienced operators alike, and neither reliably removed by training. Raja Parasuraman and Victor Riley named the same pattern misuse in "Humans and Automation: Use, Misuse, Disuse, Abuse" (Human Factors, 1997): overreliance that degrades monitoring. That work comes from aviation and clinical decision support, not from research on AI agents, so it is an analogy, but one with an unusually strong base.
So your verification cost is not the careful check you do on day one; it is the average check you do in month three. Score the task with the month-three number.
The countermeasure is not more diligence. Sample deliberately instead of checking everything badly, and put one check in the process nobody can skip without noticing: a total that must balance, a count that must match, a field that must not be empty.
What makes a task cheap or expensive to undo?
Undo cost is what it takes to reverse a wrong result from the AI agent once it exists. It rises in steps:
- Output only you saw.
- A record in a system you control, with a history, that can be rolled back.
- A record with no history.
- Something that has left the company.
- Something that has created an obligation: a price quoted, a date promised, a payment made.
Then comes the multiplier everyone forgets, which is frequency. A task that runs once a quarter and is wrong once is an incident. The same task running hourly through the working day, wrong since Monday morning, is not one incident: three full days at one run an hour is twenty-four wrong results, plus six more before the first complaint lands on Thursday afternoon. That is about thirty, each already sitting somewhere.
Reversible is not the same as free. Undoing a hundred wrong records in a system you control is possible and will still wreck somebody's week. Score the effort of undoing, not the theoretical existence of an undo.
How do you score a task in five minutes?
Score the task on the two costs, in order, and write the reason down. Five steps, one pass, no workshop.
- Write the task as one sentence naming the input, the action and the output. If you cannot, the task is not defined well enough to hand to anyone, and that is your answer today. It is also why a pilot stalls when the process was never actually defined.
- Estimate how many minutes the task takes one person, once. Use the boring middle case, not the worst one.
- Estimate how many minutes a real check takes at month-three attention. If checking is more than roughly a third of the work, the handover pays only if you can reshape the output and make checking cheaper. That third is a judgement threshold offered to make the test usable, not a measured finding. Take a twelve-minute task running two hundred and forty times a month: a four-minute check keeps eight minutes a run, which is 1,920 minutes, or thirty-two hours a month; an eight-minute check keeps sixteen hours. Half the return, and only checking moved.
- Name the realistic worst wrong result and write what undoing it costs, as effort and as who has to be told.
- Place the task on the delegation scorecard and pick the access level that quadrant requires. Write the reason in one line, because you will be asked for it later and because it becomes the first line of the AI agent's instructions.
One disqualifier. If two competent people on your team disagree about what a correct output looks like, stop. An AI agent cannot be right about a question your team has not answered.
Which tasks should a small operations team hand over first?
The boring, repeating, high-frequency work nobody defends in a meeting. Recurring reporting. Reconciliation between two systems. Inbox and request triage with a draft-only default. Data entry from a document into a record. Routine lookups that are expensive today only because they interrupt somebody.
Those win on both axes at once: what the AI agent hands back is structured enough to check quickly, the frequency makes the saving real, and undo cost is low because the work lives inside systems you control. The bucket everyone writes about instead is autonomous customer communication, negotiation, unattended customer-facing work. Wrong first choice: undo cost is high, checking demands judgement, and frequency is low, so even a perfect result saves little.
The best first task is usually one that is not on anyone's improvement list, because it is too small to have made the list and too frequent to be cheap.
What work should not be automated with AI?
Five categories, and none of them is about capability:
- Decisions where a person has to be accountable.
- Judgements that rest on knowledge nobody wrote down.
- Work whose correct answer your team cannot define.
- One-off tasks.
- Work whose failure is silent.
Accountability. Some sectors and jurisdictions expect meaningful human oversight of certain decisions, so check your own rather than assuming. That is a note, not legal advice; the regulatory ground belongs to the companion guide, where the score flips once the agent can write, not just draft.
Unwritten knowledge. A promise made on the phone, the history with one account, why the exception was granted last time. A person fills that gap from memory. An AI agent cannot fill a gap it has no access to, and will answer confidently anyway.
Undefined correctness. If two people disagree about the right output, delegating turns a disagreement into an artefact nobody can review.
One-offs. Writing instructions good enough to follow takes longer than the task, and they are never used again.
Silent failure. If a wrong result would sit unnoticed for weeks, the task is not ready to run unattended. If you cannot answer how would we find out?, that is the finding.
This is not a list of things AI is technically bad at. It is a list of tasks where the person delegating does not carry the cost of being wrong.
How does draft access change the score?
Access level changes the undo cost and nothing else. The same task scored with draft rights and with write rights lands in two different quadrants, because a wrong draft costs a minute and a wrong send costs a customer.
| Access level | What the AI agent does | Where it puts the task |
|---|---|---|
| Read only | Looks, summarises, compares, commits nothing. | Leaves the task where it was; use it while you calibrate the cost of checking. |
| Draft only | Prepares the finished work and stops before committing; a person completes it in one click. | Moves an expensive-to-undo task into the quadrant you can delegate today, provided checking is cheap. |
| Write with a stop rule | Completes the work and stops on named conditions. | Fits tasks already cheap on both axes and running often enough to matter. |
The default should be draft-only, not read-only. Read-only feels safe and leaves you at the last metre: a person still does the committing, the saving never appears, and the pilot gets judged on work it was never allowed to finish.
Ask where the restriction is enforced, and read the answer against the sibling guide on approval gates. In Botonom the permission check sits inside the capability at the data layer, and it is deny by default: a capability can be installed and still expose nothing until an administrator grants it, so only granted tools ever reach the model. The pattern matters more than the product.
What does a wrong delegation actually cost?
More than the run itself, and in a currency that appears on no invoice. Price the outcome, not the token. The components: the work the AI agent did, the check that failed to catch it, the rework, the downstream cost if the result left the company, and the expensive one, which is trust.
Trust cost is the part nobody writes down. After a single visible bad output, people go back to checking everything. The saving does not shrink, it disappears, and it stays gone until somebody deliberately rebuilds confidence with a smaller, better-scored task.
What drives the operating cost of an AI agent turn is not the length of the message somebody typed. It is the standing instructions, the tool definitions, the documents retrieved and the conversation history carried forward.
How do you write instructions an AI agent can actually follow?
Write them as you would for a person, plus the three things a person brings from experience and an AI agent does not: exact inputs, a decision rule in business language, and a rule for stopping. A human procedure is a reminder for someone who already knows the job. An agent procedure is the job. Beware the search trap: most guidance under this heading is about writing procedures with AI, not about writing instructions an AI agent will follow.
| Field | What it must contain |
|---|---|
| Inputs | Named exactly: which report, which mailbox, which date range. |
| Decision rule | In business language. Names the outcome, never the tool. |
| Stop rule | Named conditions under which the AI agent stops and asks instead of continuing. |
| Definition of done | A checkable output, not a description of effort. |
| Missing-input behaviour | What to do when something the procedure assumes is not there. |
Rules that name the outcome survive a change in the system underneath; rules that name the tool break quietly. The stop rule is where task-level instruction meets role-level authority, which is the work of turning a list of delegated tasks into a written scope of authority. Missing-input behaviour is the field everyone forgets: a person sees the report came back empty and asks, while an AI agent without a stop rule produces a confident, beautifully formatted answer about nothing.
A rule this specific is worth storing where the agent reads it every time, rather than pasting it into a chat and hoping. In Botonom these are called standing rules: someone writes the rule once, in business language, without naming a tool, and it is applied on every following turn. We tested that end to end. After the rule was set, a later conversation in which the person only wrote approve produced the follow-up task on its own. The mechanism is not the interesting part. The interesting part is that a rule which names the outcome keeps working when the system underneath it changes.
A worked example: the Monday revenue report
Today's human procedure is one line, and deliberately vague: pull last week's numbers and circulate the summary. Rewritten with all five fields, it reads in ten seconds.
Inputs: the revenue export for the previous Monday to Sunday, by channel. Decision rule: report revenue by channel with the change against the previous week beside each figure. Stop rule: stop and ask if any channel moved more than the agreed threshold against last week, if a source returned an empty row, or if the range does not cover a full week. Definition of done: one table, seven days, every channel present, previous week beside current week, posted to the team channel by 09:00 on Monday. Missing-input behaviour: if the export is unavailable, say so with the time it was attempted, and do not estimate.
That rewrite took about ten minutes and it is reusable, which is the whole argument for why a one-off task is genuinely different.
Does giving an AI agent more tools make it better?
Past a point, no. Every capability you install adds an option at the moment of choosing, and beyond some number the problem stops being cost and becomes accuracy: the AI agent starts choosing between candidates that look a great deal like each other.
Tiantian Gan and Qiyao Sun measured this in a 2025 arXiv preprint on retrieval-based tool selection, varying the number of candidate tools from one to 11,100 across twenty-six intervals: retrieving a small relevant subset instead of presenting the whole set raised selection accuracy from 13.62 percent to 43.13 percent and cut prompt tokens by more than half.
Measured on one of our own production agents, with fifteen capabilities installed, selecting only the one to three capability sets a message actually needed took the standing instructions from roughly 115,000 tokens to roughly 13,000, and the wait before the first word appeared from about fifteen seconds to about two and a half. That is one agent, one configuration, one point in time, not a benchmark and not a customer result.
So run a capability budget per agent: install what your scored tasks require, not what looks impressive in a catalogue. If one AI agent needs a capability for one task a month, that is an argument for a second agent, not a bigger one.
When should you re-score a task you already delegated?
When either of the two costs moves. Four triggers cover most of it: volume changed meaningfully, access went from draft to write, a source system changed, or the person who checks the output changed.
Add a fifth trigger that is not an event. Re-score on a fixed cycle even when nothing visible has changed, because the thing that decays is the checking itself, and it decays quietly while everything looks fine.
Re-scoring a task is not the same as reviewing whether the AI agent is doing the work. That is a separate discipline, with its own questions about what gets logged and what gets looked at each week.
Take the most boring repeating task on your list, too small to have made anyone's improvement plan, and score it honestly on both axes before you delegate a single thing. Cheap to check and cheap to undo? Hand it over draft-only and look again in a month. Expensive on both? You already had the answer, and it was worth five minutes to know it. For a wider read, the AI readiness assessment returns a score on several dimensions plus an estimate of the hours you could get back.
Frequently asked questions
Should I let an AI agent send emails on my behalf?
Not as a starting position. Sending is close to irreversible, so it belongs in the draft-only quadrant: let the AI agent prepare the message in full and stop before it goes out, with a person committing in one click. Move to sending only after the drafts have been right at real volume.
Is read-only access enough for an AI agent to be useful?
Read-only earns its place while you are still measuring how long checking takes, and for lookups that interrupt someone today. It stops being enough the moment you want the time back, because the last step still lands on a person. Once you know what checking costs, move to draft-only.
Can I delegate a task that has no written process?
Not until you can state it in one sentence: the input, the action, the output. Until that sentence exists there is nothing to hand over, and no AI agent will supply the missing definition for you. An undefined process is the most common reason a promising handover quietly stalls.
How many outputs should I check before I stop checking every one?
There is no universal number. The right sample is the one you will still be taking in six weeks, so choose for what you can sustain rather than for what looks thorough in week one. Raise it whenever volume, access level or a source system changes, because each of those moves the cost of being wrong.
How many tasks should one AI agent be given?
As many as share one purpose and one set of inputs, and few enough that one person can still tell whether the work is being done. Supervision, not capacity, is the binding constraint: one AI agent holding six unrelated jobs is six things to check, and nobody checks six things well.
Does each task need its own instructions, or does the role cover it?
Both, at different levels. The role sets what the AI agent is accountable for and what it may decide; each delegated task still needs its own inputs, decision rule, stop rule, definition of done and missing-input behaviour. Role-level authority without task-level instructions produces confident work on the wrong thing.
