The hype cycle for autonomous AI agents is colliding with the reality of production environments, and Isabelle Dubuis has the patch notes. In a new guide published on October 26, 2026, Dubuis argues that if a workflow can be completed by a predictable rule, an AI agent is the wrong tool. The core thesis is simple but brutal: do not decide by the word 'agent.' Decide by uncertainty, consequence, reversibility, and evidence. Grant autonomy only after you can name the exact action, prove it is permitted, and cap the damage from a wrong step.

The Three-Tier Autonomy Model

Dubuis distinguishes between three tools that developers frequently conflate. Rule automation executes defined paths and suits repeatable inputs. An AI assistant interprets material but leaves the final decision to a human. An AI agent, however, selects tools and sequences actions without intermediate approval. The Canadian federal guide cited in the article describes this distinction in terms of action: generative AI produces an output, while agentic systems interact with digital systems inside boundaries. The risk surface changes dramatically when a system moves from drafting a refund message to approving it and changing accounting records.

Hard Gates and the Deployment Ladder

Before any value score is calculated, Dubuis mandates four hard gates: consequence, reversibility, authority, and observability. If consequence is high and reversibility is low, a human approval step is mandatory immediately before action. If authority is unclear, the workflow must be blocked regardless of model confidence. The guide proposes a deployment ladder starting with offline evaluation, moving to read-only pilots, then draft-only pilots, and finally limited external actions. Do not jump from a polished demo to a live write because the model worked on a few examples; the risk profile changes when credentials are connected.

The 12-Case Acceptance Suite

The centerpiece of the guide is a 12-case acceptance suite designed to force owners to specify expected behavior before touching customer records. These are not observed incidents but designed scenarios that test edge cases like 'Conflicting data,' where two approved records disagree, and 'Hostile content,' where a document attempts to override policy. Other critical tests include 'Duplicate event' handling to ensure idempotency, and 'Connector timeout' scenarios where a write may have succeeded despite a timeout. Passing these cases does not prove safety in every context, but failing them proves the system is not ready for production credentials.

Operationalizing the Preflight Gate

Dubuis provides a Python preflight function that rejects proposed production actions unless specific policy facts are established. The function checks if the data source is approved, the operation is allowlisted, and the action is observable. Crucially, the function receives these facts as inputs; it does not ask the model to determine its own permissions. If the agent can set source_approved=True for itself, the gate is meaningless. This code serves as a design sketch for the organizational controls that must exist outside the model's narrative.

Key Takeaways

  • Autonomy must be capped by reversibility; if an action cannot be undone, it requires human approval.
  • The 12-case suite includes tests for hostile content, stale records, and unauthorized operations.
  • Observability is a hard gate; if you cannot reconstruct what the system saw and did, do not deploy.
  • A timeout does not prove a downstream system did nothing; reconciliation is required before retrying.

The Bottom Line

Most 'agent' failures are actually governance failures. If your team cannot write concrete exclusions for what the system must never do, you are not ready for an agent; you are ready for a mess. Start with the smallest useful autonomy level and let the audit trail, not the demo, dictate your next move.