Specifying the Delegated-Autonomy Boundary: Requirements Engineering for Agentic AI

What it claims

The paper (ASE 2026 NIER track, Arora/Vogelsang/Sharma) doesn't just name the "delegated-autonomy boundary" — it proposes two concrete, usable artifacts and a three-tier authority model. It scopes itself to high-autonomy, multi-step agents with cross-system action, explicitly excluding single-step LLM-in-a-pipeline "agents." It names two failure modes it targets: unjustified agency (building an agent when a prompt or deterministic workflow would do) and under-specified agency (authority, memory scope, escalation buried in prompts/tool schemas). This is a vision/NIER paper developed with two senior practitioners (enterprise agents; healthcare), not an empirical study.

How it works

Two artifacts, applied in sequence:

AJR (Agency Justification Record) — a gate completed before architecture is chosen, analogous to an ADR. Six positive criteria: (1) open-ended task structure, (2) unstructured context, (3) cross-system actions, (4) evaluable progress, (5) bounded risk, (6) measurable advantage over baseline with a pre-committed threshold. Plus anti-criteria that disqualify regardless (fixed workflow already adequate; unverifiable outcomes; irreversible/high-stakes actions; multi-agent for "neatness").

ADP (Agentic Delegation Policy) — extends (does not replace) the SRS once an agent is justified. Six dimensions: Purpose (incl. explicit stop conditions — max attempts, deadlines, uncertainty thresholds), Authority, Information & Memory, Coordination, Assurance, Evolution.

Authority is graduated into three tiers, aligned to OpenAI's risk factors (write access, irreversibility, permissions, monetary impact):

• Autonomous — execute without review (read-only, low-cost ops)
• Advisory — propose but require human approval
• Prohibited — never, regardless of instructions (irreversible high-stakes, out-of-domain)

flowchart TD
  A[AI-enabled feature] --> B{AJR: 6 criteria +<br/>anti-criteria}
  B -->|fails| C[Prompted model /<br/>deterministic workflow]
  B -->|passes| D[ADP: specify 6 dimensions]
  D --> E[Authority tiers:<br/>Autonomous / Advisory / Prohibited]
  D --> F[Compile to prompts, tool schemas,<br/>orchestration, monitors, eval tests]

Evidence

No experiments; the "evidence" is two worked examples run through both artifacts. A hospital discharge coordination multi-agent system (orchestrator + medication/payer/discharge sub-agents, HIPAA context) clears all six AJR criteria → proceeds to ADP. An automated code-review agent fails criteria 1–3 and 6 (enumerable tasks, structured diffs, read-only, little projected gain) → rejected in favor of a prompted-model pipeline. The paper cites a deployment gap it uses as motivation: 25/30 deployed agents disclose no internal safety evaluations, 23/30 have no third-party testing (attributed to ref [19]).

Limits

• Vision/position paper, not validated — no user study of the artifacts, only illustrative examples and consultation with two practitioners.
• Authors explicitly narrow the claim: delegated autonomy does not exhaust agentic RE; stakeholder goals, usability, ethics, and regulatory compliance are treated as orthogonal, handled by the SRS.
• The paper leaves four open problems as future work: notations, requirements-to-runtime compilation, requirements-driven evaluation, and accountability.
• The fetched text is truncated inside the Table 2 ADP example (cuts off at the discharge agent's "Prohibited" tier), so the full illustrative ADP is not visible here.

Worth reading if you are designing agent governance or writing specs for cross-system agents; the AJR checklist and three-tier authority model are directly borrowable as review artifacts even before the framework is empirically validated.