Delegation

NIST's 27 October design tenets answer how much autonomy an agent should have by handing risk thresholds to the deploying organization. OWASP's AISVS already tests much of the machinery, including when a human must approve an irreversible action. Neither document tells you what your thresholds are, or how much escalation a reviewer can absorb before approval becomes habit.