How Much Authority Should You Give an AI Agent on the Mainframe?

The mainframe world is moving toward agentic AI, but most organizations are giving it too much autonomy too soon, or too little to be useful. Here's the framework.

The question every IT leader is asking right now

The real question facing IT leaders today is how much control to hand an AI agent, and when to hand over more. Most teams have already settled whether they'll use AI in operations. What they haven't settled is where the agent's authority should stop.

The pressure is real. Batch windows keep shrinking. Alert volumes keep climbing. The experts who can read a system dump at 3 a.m. are retiring faster than you can replace them. AI agents promise to diagnose, decide, and act at machine speed.

But the systems you run process payments, settle claims, and move patient records. You're being asked to trust something you can't fully see, inside an environment that can't afford a bad day.

That hesitation isn't irrational. It's correct risk awareness. What follows is a practical framework for extending AI authority safely: what to delegate now, what to hold back, and how to earn your way to more autonomy over time.

What is human-in-the-loop AI, and why does it matter?

Human-in-the-loop AI is an operating model where the AI agent recommends and prepares actions, and a human reviews and authorizes them before anything executes. The agent does the analysis and the legwork. The human keeps the final decision and the accountability.

It sits between two extremes:

• Insight-only AI surfaces information and stops there. It's safe, but it leaves your team doing all the work.
• Fully autonomous AI acts without per-action approval. It's fast, but every decision rests on the agent's judgment alone.

For regulated industries, the middle ground is where most operations need to live today. You get the speed of AI-driven diagnosis and preparation, and you keep a named human accountable for every consequential change.

Most IT leaders already operate this way. According to research Rocket Software commissioned with Hanover Research, 48% of IT leaders permit AI to take limited actions while humans remain accountable, and 34% allow AI to provide insights only. Very few organizations have handed AI full autonomy. Their caution reflects a clear understanding of what's at stake.

The AI Authority Ladder: How to extend trust incrementally

You should extend AI authority one level at a time, based on demonstrated accuracy, rather than deciding on day one how much autonomy an agent gets.

The AI Authority Ladder is a four-rung framework for doing exactly that. Each rung grants the AI agent more authority than the one below it, and each rung has to be earned by proven performance at the previous level.

• Rung 1, Observe: The AI monitors systems and surfaces information. It takes no action and makes no recommendations.
• Rung 2, Recommend: The AI suggests specific actions and explains its reasoning. A human decides whether to act.
• Rung 3, Act with Approval: The AI prepares and executes actions, but high-risk steps pause for human sign-off before proceeding.
• Rung 4, Act Autonomously: The AI executes within a predefined, well-tested scope without per-action approval.

Most regulated mainframe environments should operate at rungs 2–3 today. That's where you capture most of the value, including faster diagnosis, prepared remediation, and fewer hours lost to manual triage, while keeping humans accountable for changes that matter.

Two principles make the ladder work in practice.

First, assign authority by action type, not by agent. The same agent might sit at Rung 4 for opening incident tickets and at Rung 2 for anything touching security configurations. One blanket setting for the whole agent is either too loose or too tight.

Second, Rung 4 is earned, never assumed. Track how often the agent's recommendations match what your experts would've done. When an action type shows consistent accuracy over a meaningful period, promote it. When it doesn't, it stays where it is.

What "high-risk" actually means in a mainframe context

An action is high-risk if it's difficult to reverse, touches live transaction data, or has downstream dependencies across systems. If any one of those conditions applies, a human should approve it.

Actions that should always require human approval:

• Restarting production batch jobs during business hours
• Modifying security configurations or access permissions
• Purging or archiving data
• Changes that span multiple subsystems at the same time

Actions generally safe for autonomous execution within defined parameters:

• Correlating logs and flagging anomalies
• Generating diagnostic summaries
• Opening and enriching incident tickets
• Surfacing historical pattern matches from past incidents

Notice the pattern. Everything on the autonomous list produces information. Everything on the approval list changes system state. That distinction gives your team a simple, defensible rule to start from, and you can refine it as the agent proves itself.

What good governance architecture looks like in practice

Good AI governance architecture ties every action to an identity, logs every decision immutably, and gates every high-risk action behind explicit human authorization. Those three requirements are non-negotiable before you extend AI authority at any level of the ladder.

• Every action tied to an identity. You should be able to see which agent acted and which human approved it, as two separate records.
• Every decision logged immutably. The record of what the AI did, and why, can't be edited after the fact.
• Every high-risk action gated. The agent can't proceed until a human explicitly authorizes the step.

Rocket^® EVA^™ was built for this model. Rocket EVA operates with human approval gates on high-risk actions: the agent diagnoses, recommends, and prepares the remediation, and a human authorizes it before execution proceeds. Every action is tied to both an agent identity and a human approver on record, so you can answer an auditor's questions without reconstructing events from scattered logs.

Rocket EVA also enforces operational rules through policy-as-code and a deterministic execution core, so agents can only take validated actions within approved boundaries. You don't have to start at the top of the ladder. Many teams begin with lower-risk use cases like nightly batch failure triage, build confidence in the agent's accuracy, and expand its authority one action type at a time.

That's how you modernize without disruption. You climb deliberately, with proof at every rung.

See how Rocket EVA's governance architecture manages AI authority at every level

Rocket is a trademark of Rocket Software, Inc. and its affiliates.