Access is not authority
An AI system may need to read an invoice without being allowed to pay it. It may identify an overdue customer response without being allowed to send one. Giving AI a job should mean deciding both what information it can use and which actions it may take. Those are separate choices.
Define one responsibility
Start with a narrow job, such as reviewing invoice exceptions. This is a hypothetical example, not a customer case study. Define the records it may inspect, the differences it should flag and the person who receives the result. Decide which actions are read-only and which need approval. Set a budget and a stopping rule before expanding the role.
Keep permissions outside the model
Holiday enforces access permissions in application code, independently of the AI model. Business Chat works with the information approved for the user. Agentic Managers work within the responsibilities, credentials and authority assigned to their role. A model response is not permission to reach beyond that boundary.
Review the work as well as the answer
A convincing answer is not enough. A business needs to know what information was accessed and what changed. Holiday records AI activity in an audit trail so that work can be inspected. A record supports oversight; it does not replace the judgment of the person responsible for the outcome.
Plan the exception path
Missing information and conflicting records are normal business conditions. Decide when AI should stop and return the decision to a person. A role should not gain broader authority merely because a task becomes inconvenient. Check these cases before widening the responsibility.
Expand deliberately
After reviewing a narrow responsibility, decide whether the business can supervise a wider one. The useful measure is work completed within clear boundaries, not how many tools a demonstration can call. Business AI needs a defined job, a defined limit and a path back to a person.