Ona, NICE, Brex and Uber gave AI systems authority over a decision. None of them used an autonomy level.
On 13 March 2026, an AI agent at the software company Ona approved a pull request without a human reading it. A human still had to merge it. That separation is the whole design.
Ona's engineering team published the criteria. A change qualifies for automated approval if it touches fewer than a thousand lines and contains no protobuf changes, no database migrations, no infrastructure or CI configuration, no authentication or authorisation logic, and nothing touching audit logging or monitoring. Fail any one and a human reviews it. The classification is performed by an automation rather than by the engineer who wrote the change, so nobody can move their own work across the line.
The merge stays human because it is the auditable approval event Ona's SOC 2 process depends on, and moving it would cost them the record. So the agent holds the authority to say a change is acceptable and none of the authority to put it into production. The policy was not designed in the abstract either. The team spent two weeks watching which pull requests a human reviewer approved without adding anything, then drew the boundary around what they saw.
Nobody in this article published an autonomy level. No scale, no tier, no rating from one to five. Each of these four organisations took a process apart, found the decisions inside it, and granted or withheld authority at each one separately, on stated terms. A quantity, not a switch argued that autonomy is a quantity rather than a state you flip. Nothing here displaces that, it locates it. The quantity is set per decision rather than per system, which is why no single number describes any of them.
In May 2025, NICE recommended that DERM, an AI system for assessing skin lesions, could be used in NHS teledermatology for patients on the urgent suspected skin cancer pathway. It can identify lesions needing no dermatologist review, removing those patients from the pathway without a specialist seeing them. What NICE issued is closer to a lease than a permission. DERM may be used during a three-year evidence generation period, provided the evidence in NICE's plan is actually being generated and the system holds its regulatory approvals, and NICE may revise or withdraw the guidance if those conditions are not met.
Inside that licence the authority is not uniform. For people with black or brown skin a healthcare professional review remains mandatory, because the evidence on accuracy in darker skin is weaker. Same system, same task, different authority by population, keyed to where the evidence supports the delegation.
The evidence underneath is contested in a way that matters. In studies the committee considered, at two NHS trusts, a second-read reviewer overturned between 40% and 50% of the cases DERM had marked as eligible for discharge. That figure sits inside the recommendation rather than outside it. The authority was granted with the disagreement on the record, which is rarer than it should be.
Brex rebuilt its customer onboarding, the checks a business passes before it gets a card, as a system of specialised agents, and went from approving none of its applications automatically to approving roughly 40% in weeks. Before it moved, it set a bar. Brex studied how its analysts worked, wrote down judgements that had never been written down, and rebuilt its historical cases into a labelled benchmark.
Against that benchmark the system had to catch every bad actor a human caught and some the humans had missed, never reject a customer a human would have approved, and always explain the decision. Agents were built to be able to say they were unsure, and uncertain cases route to an analyst whose decision feeds back as a labelled signal. What Brex publishes is the bar. What it does not publish is the evidence the bar was cleared, and the results appear as a chart described as moving up and to the right, with no accuracy figures and no false-negative rate.
A boundary that exists only in a policy document is a boundary the system does not know about. Uber's engineering team published in May 2026 an account of making one enforceable at the point of action. Every agent runs as a workload with a cryptographically signed identity, only a central token service can mint tokens on an agent's behalf, and each token is issued for a single hop, carries a specific audience claim and lives for minutes. A token minted for one agent to call another cannot be replayed against a database.
Each token also carries the full chain of everyone involved, so a request arriving at a tool shows the originating engineer, the agent they invoked, and the agent that one delegated to. Uber's stated reason is a failure they kept seeing, where an agent opened a pull request and the record showed only that an agent had done it. Authorisation then happens at a gateway, per tool call, against both the human's identity and the agent's. Ona, Brex and Uber are all describing their own systems, which is good evidence of what was decided and none at all that the boundaries hold in production. NICE is the exception.
Granting authority is the easy half, and the harder question is who may widen it later. At Ona the platform team owns the classification tooling, and any change to the evaluation logic, the criteria, or the agent's review prompt requires explicit approval from the Head of Product Design and Engineering. Swapping the underlying model counts as a material change to the policy. Changing the model is a governance event at Ona rather than an engineering one.
NICE names its diagnostics advisory committee, and then something more revealing happened. Requests were made to a resolution panel on the grounds that NICE's published process had been breached. The panel found the framework had not been followed, and that had it been followed, DERM would have been recommended for use while evidence was generated. The recommendations were amended accordingly. A committee reached one position, a panel found the process had not been followed, and the authority granted to the system changed. Who decided has a second layer, and it is on the public record.
Brex names a partnership between its risk specialists and its engineers, and no individual or committee that authorised 40%. Uber names the teams that built the architecture, and nothing about who assigns the risk classification that decides which systems get mandatory policies. In both cases the boundary is real and the person accountable for its position is not identified. Two out of four, and that ratio is the finding.
Uber also publishes the price of its own control. The 99th percentile latency on the token exchange sits consistently below 40 milliseconds, and they show the graph, because the obvious objection to authorising every hop is that one task might involve dozens. NICE prices its second read directly. The DERM assessment is £30 per referral, an NHS teledermatology review adds £8.20, and a second read by the company's own dermatologist adds £17. Against that, the assessment group estimated a healthcare professional review could raise sensitivity from around 95% to about 98%, with specificity lower than the automated system alone.
Ona and Brex publish neither price. Ona reports that lead time fell from 4.1 hours to 1.1 and deployments rose from 329 a week to 1,037, and reports no defect rate, no escaped-bug count and no incident data for automatically approved changes. Nor does it say why a thousand lines is the right threshold rather than five hundred. Two of these four measured what their control cost. Two published the benefit and stayed quiet about the price.
None of them assembled this machinery because they wanted to. Uber built on published standards and then customised them, because carrying provenance across hops in a way its auditing and performance requirements could live with was not something any standard did. The IETF's WIMSE working group has six adopted documents in progress and a seventh with the IESG, and every one answers a version of the same question, which is which workload holds this credential.
Alongside them sit ten further drafts that no working group has adopted, and those are the ones about carrying a person's delegated authority through a chain of agents. Attenuated delegation, signed authorisation-evidence records, cross-organisational delegation, the last revised on 31 August with delegation-chain integrity filed on 8 September. They are not stalling, they are arriving faster than anyone is adopting them. The cross-organisational draft says existing mechanisms cannot adequately express, constrain or verify authority delegated recursively among agents. It enumerates requirements and declines to specify a solution.
There is a boundary on how much of this a standard could ever carry. A protocol could express that authority was delegated, that it was scoped, that it narrowed at each hop, and that the chain is verifiable. No protocol will tell you that a thousand lines is the right threshold, or that patients with darker skin need a second reader, or that 40% is the right share of applications to approve automatically. The mechanism is standardisable. The judgement is not.
We have adopted standards for proving which piece of software is calling, and none for expressing what a person allowed it to do on their behalf. Where the rule lives looked at what happens when that machinery sits in the wrong place, and putting it in the right place still means assembling most of it yourself. In each of these four, something now enforces the boundary automatically, whether a classifier, a gateway or a routing rule. Those controls hold real authority and they act without being asked, which raises the question of what sits above them.
Sources
- Ona, How auto-approving low-risk PRs with AI cut our lead time by 74%, Benjamin Stark, 9 April 2026
- NICE, Artificial intelligence technologies for assessing and triaging skin lesions referred to the urgent suspected skin cancer pathway, early value assessment (HTG746), 1 May 2025; migrated from HTE24 in December 2025 with recommendations unchanged
- Thomas and others (2023), second-read overturn rates at two NHS trusts, as recorded in the NICE committee discussion
- Brex, The end of the trade-off, how AI agents broke the onboarding trilemma, undated
- Uber, Solving the Identity Crisis for AI Agents, 21 May 2026
- IETF, Workload Identity in Multi System Environments working group document list, retrieved 9 September 2026
- IETF, Cross-Organizational Delegation for Workload and Agent Identity, Problem Statement and Requirements, draft-reece-wimse-cross-org-delegation, revised 31 August 2026
- IETF, WIMSE working group interim meeting minutes, 3 June 2026
The Ona, Brex and Uber accounts are written by the organisations that built the systems described, and no independent verification is claimed for any of them. The NICE recommendation is a public body's published reasoning against an evidence base its own committee describes as limited. The prose was drafted with AI assistance. The research, verification and editorial decisions are the author's.