AI agents promise to accelerate credit, procurement, finance, and onboarding operations. But the promise comes with a question: who actually decides? According to Deloitte (State of AI 2026), 95% of companies in Brazil plan to adopt agentic AI within two years. At the same time, only 27% say they have a mature governance model for it — compared to 21% globally. SAP (2026) shows that 35% of Brazilian companies lack a human-in-the-loop process for agent-driven workflows. And AWS (Unlocking AI Potential in Brazil 2026) points out that only 6% of companies using AI in Brazil already operate with agents.
The risk is clear: an agent without human authority can approve a purchase outside the budget, release credit above the risk limit, or onboard a supplier without compliance verification. The solution isn't to block the agent. It's to design an authority matrix that lets the agent prepare the decision and delivers final approval to whoever has authority.
What is an authority matrix for AI agents
An authority matrix defines who can approve what, up to which amount, and under what conditions. For AI agents, the logic is the same, but with one difference: the agent checks documents, fills in fields, cross-references data, and prepares the recommendation. The final decision stays with a person — or two people, if the amount or risk requires dual approval.
Hypothetical example: a credit agent analyzes financial statements, consults the credit bureau, calculates a score, and suggests a limit of R$ 80,000. If the suggested limit is below R$ 50,000, the analyst approves alone. Between R$ 50,000 and R$ 200,000, it requires dual approval (analyst + manager). Above R$ 200,000, it goes to committee. The agent prepares everything but releases nothing without human authority.
Automatic approval only within a limit defined by a person
Automatic approval exists, but it only works within a range that someone with authority defined beforehand. In procurement, for example: the operations director authorizes recurring purchases of supplies up to R$ 10,000 per order, as long as the supplier is approved and the month's budget isn't exceeded. The agent checks all three conditions. If all are true, the purchase is automatically approved. If one fails, the request escalates to manual approval.
This logic protects the company on two fronts: it frees the operations team from approving trivial requests and ensures exceptions go through someone with context and authority.
Dual approval above a threshold
Dual approval is a classic audit control. For agents, it works as a safety lock. When the amount, risk, or novelty exceeds a threshold, two people need to agree before proceeding.
Hypothetical example: a supplier onboarding agent verifies tax ID, certificates, references, and history. If the supplier is new and the contract involves advance payment above R$ 100,000, the agent prepares the dossier and sends it for dual approval: buyer + compliance. Neither approves alone. Both need to agree. The agent records who approved, when, and based on what data.
Trail of who did what and when
An audit trail is a compliance requirement, but it's also a management tool. Every agent action and every human approval is recorded: who requested, who checked, who approved, when, with what justification, and based on what data. The record is chained (SHA-256 or equivalent), making any retroactive change visible.
This trail serves internal audit, external audit, dispute resolution, and even agent training. If an approved credit turns into default, the trail shows what the score was, who approved it, and why. If a purchase exceeded the budget, the trail shows where control failed.
Governance that scales without losing control
An authority matrix for AI agents isn't a bottleneck. It's decision architecture. The agent accelerates preparation, the person with authority decides, and the trail records everything. Credit, procurement, finance, and onboarding gain speed without losing control.
IN · Business Intelligence transforms recorded meetings or process descriptions into BPMN maps, pain point maps, opportunities with gains in hours and currency, to-be redesign, and AI agents with checklists. Each agent checks and prepares. The person with the right authority decides. Everything is recorded in a ledger chained by SHA-256, verifiable. The authority matrix comes ready from the mapping, with the limits and rules the operation already uses — or should use.
Source: Deloitte, State of AI 2026; SAP (2026); AWS, Unlocking AI Potential in Brazil 2026
Informational content. Numerical examples are hypothetical.