A line drawn on a whiteboard does not survive the second deployment
By the tenth deployment we mean the tenth time the same use of agents must run somewhere new: another business unit, country, ERP or platform. That is where scale is really tested. Architecture documents and responsibility matrices record intent, but a rule that should hold on every action cannot depend on the team's memory. Scale is not project discipline; it is a property of the system that operates.
Data stays in the client's stack. A separate control plane carries decision, mandate, authorization checks and the record of each act. Data becomes decision context only when admitted for a purpose, with origin, meaning, freshness, quality, permission and owner.
The person authorizes the mandate; the agent acts within it
Eligible actions run when the authorized policy allows. The agent never approves its own proposal or widens its authority. Platform and third-party agents propose; their proposals pass the same mandate, check and receipt. Financial limits are checked on every call; outside the envelope the action becomes a proposal. Autonomy is earned by evidence, reduced automatically when criteria are breached, and restored only by an authorized person.
Human review is assessed too: approving without opening the evidence does not count as review, and opening it is not enough. Signals are combined with sampled review and later outcomes, aggregated, never ranked by person.
Cognitive sovereignty: what agents learn belongs to the organization
With agents on many platforms, learning disperses too: context, corrections, handled exceptions and the organization's way of working. Left inside each vendor's model, that knowledge ends up scattered and uncurated. As Bramley Maetsa wrote in ITWeb: "Its data may be sovereign. Its learning may not be."
Cognitive sovereignty has two faces, and both are conditions for scale. Learning belongs to the organization: agents' memory, knowledge and skills stay in its environment, with human curation, author and history, outside the vendor's model. Judgment belongs to people: human mandate, assessed review and the ability to contest or stop execution.
Fiduciary responsibility: delegating execution is not delegating responsibility
An agent acts on behalf of the organization, which acts on behalf of clients, shareholders and regulators. The real question is fiduciary: who conferred authority on whom, for what purpose, until when, and who answers for its use. A mandate is born pending and takes effect only when the accountable person accepts it by name; it states purpose, actions, objects, budget limit and validity. Requesting, approving and executing are separate roles by risk, and attestation is done by someone other than the decider.
Governance must be evidenced, not declared. For any act of any agent on any platform, the trail shows who acted, under which mandate and authority, with which evidence and effect, and what was denied. It can be queried by person, agent and decision; authorship corrections keep the original; audit exports are hash-chained so cuts or changes become visible.
The tenth deployment is composed — and measured
Each domain has an owner with authority, budget, recurring run cost and support capacity, and each act leaves a receipt. A receipt supports audit; it does not prove financial causality on its own.
Deployments compose a shared core with sector cookbooks, market rules and client configuration. Every new unit measures integration effort, reuse, errors, review load, total cost and business result.
For leadership: architecture without operation is not enough — it is narrative. Layer diagrams, named frameworks and a well-drawn RACI describe intent; they do not enforce the mandate at the moment of the act, deny the out-of-bounds action, assess human review or leave a receipt. Scale exists only when architecture becomes operation, run every day and verifiable by whoever must answer for it.