What to Delegate to an AI Agent (and What Not To)
Adapted in English from Chapter 3 of Agentes de IA para quem não programa (“AI Agents for People Who Don’t Program”). This article is for general information only and is not legal advice.
Beginners usually make one of two mistakes. They delegate too much, too soon — an impressive demo, then the agent is answering an important client or checking payroll — or they delegate nothing after one “so-so” test, without realising the problem was the task, not the technology.
The core idea: choosing what to delegate matters more than choosing the most powerful tool.
The frequency × risk matrix
Judge every task by frequency and risk (damage if it goes wrong unnoticed).
| Low risk | High risk | |
|---|---|---|
| High frequency | 🟢 Start here. Delegate with light review. | 🟡 Delegate the preparation, not the decision. Review is mandatory. |
| Low frequency | 🔵 Delegate if easy to instruct. Little gain, little risk. | 🔴 Do not delegate (for now). Do it yourself, with at most occasional chat help. |
🟢 High frequency, low risk: start here
Mistakes here are easy to spot and cheap to fix: a Monday sector-news summary, organising attachments, drafting a recurring agenda, turning notes into minutes. You gain time and confidence together.
🟡 High frequency, high risk: delegate the preparation
Client replies, reconciliations, and standard contract reviews happen often, but mistakes are expensive. The agent gathers, drafts, and flags; you decide and finish.
Example: instead of “reply to the billing emails”, ask: “Draft replies to the billing emails and flag any that mention disputes or different amounts.” You click “send”.
🔵 Low frequency, low risk, and 🔴 low frequency, high risk
A twice-yearly supplier search is a safe place to test new tools. Rare, high-impact decisions — dismissal, strategic proposal, court defence, tax filing — are not a place to learn: use AI at most to review or organise.
Measuring “risk” with four questions
If any answer is “yes”, treat the task as high risk:
- Does it involve money? Payments, billing, prices, quotes, taxes.
- Does it go outside? Anything reaching clients, suppliers, public bodies, or social media in your name.
- Does it involve sensitive or confidential personal data? Health, clients’ financial data, lawsuits, employee information, company secrets.
- Is it hard to undo? Deleting files, sending messages, signing, publishing, filing.
Questions 2 and 4 are about action: when the agent only prepares, risk drops; when it acts, risk rises.
What the tools themselves already avoid
Tool makers also classify by risk. In ChatGPT Work, per OpenAI’s July 2026 announcement, you decide what it can access and when it needs your approval; Auto-review reviews important actions involving connected tools before they happen, and Enterprise/Edu administrators can restrict sensitive actions. ChatGPT agent (2025) already used explicit confirmation before purchases, active supervision for sending emails, and refusal of bank transfers.
No substitute for your matrix: tool safeguards are generic, and only you know that one email to one client is more delicate than a stationery purchase.
Practical rule: use the tool’s safeguards as a floor, never as a ceiling.
Human in the loop: three levels of autonomy
- Level 1 — agent suggests, you do. It researches and proposes; you execute everything that goes out. Good for 🟡 tasks and anything new.
- Level 2 — agent does, you approve. It prepares the complete action and stops before finishing for your “OK”. Good for 🟢 tasks involving sending or changing.
- Level 3 — agent does, you check later. Only for internal, reversible 🟢 tasks, after weeks at Level 2.
No “yes” task goes to Level 3. Set the level in the goal: “Do not send anything; just draft.” “If you find different amounts, stop and tell me.”
When the law also asks for a human
Brazil’s LGPD (Law No. 13.709/2018), Article 20, guarantees the right to request review of decisions taken solely on the basis of automated processing affecting a person’s interests, including personal, professional, consumer, or credit profiling. The controller must also, when asked, provide clear and adequate information about the criteria and procedures used, respecting commercial and industrial secrets.
For decisions about people — CV screening, credit approval, client classification — plan the explanation and human review from the start. Such decisions stay in 🟡 or 🔴, never Level 3.
Three professionals, three choices
Illustrative examples — the people below are fictional, not real cases.
- Carla, HR analyst in Florianópolis — fictional example. CV screening: frequent, but personal data and decisions about people → 🟡. The agent only organises CVs by objective requirement, eliminating nobody; Carla decides (Level 1). Her monthly newsletter → 🟢 (Level 2).
- Eduardo, garage owner in Ribeirão Preto — fictional example. Parts price research: frequent, internal, reversible → 🟢 (Level 2, then Level 3 after a month). Client quotes involve money and go outside → 🟡: agent prepares, Eduardo sends (Level 1).
- Fernanda, labour lawyer in Salvador — fictional example. Weekly case-law news → 🟢, with links she checks (Level 2). An initial court petition is very high risk and confidential → 🔴 for final drafting; at most, AI organises the chronology without identifiable data.
All three delegated from the first week — without risking what matters most.
Your 4-week delegation plan
- Week 1: only the 🟢 task you circled in Chapter 1, at Level 2.
- Week 2: improve its instruction; add a second 🟢 task.
- Week 3: try one 🟡 task at Level 1, preparation only.
- Week 4: review everything. What worked can move up a level; what caused trouble goes back to manual, or gets a better instruction.
Record frequency, risk answers, quadrant, level, and start week.
Editorial note: the matrix, four questions, three levels, and 4-week plan are teaching tools proposed by the book, not official rules or standards.
Sources
Sources as listed in Chapter 3 of the book, consulted on 16 October 2026.