An agent drafts a purchase order, a client letter, a regulatory filing. The interface presents a summary and a button: Approve. One click, and the system records the reviewer as author: the person who verified the facts, confirmed policy compliance, exercised authority to commit, and accepted liability for the outcome.
Those are four distinct institutional functions. In most organizations they belong to different roles: the person who checks accuracy is not the person with signing authority, and neither necessarily bears the loss. COSO's 2026 guidance on agentic systems identifies this directly. Approving an AI-generated outcome without independently reperforming the underlying work looks like oversight but functions as delegation.
The interface compounds the problem through a basic asymmetry: approval takes one click; refusal demands justification. As agent output scales, reviewers keep clicking, systems keep logging consent, and the institutional work those clicks are supposed to represent quietly goes unperformed.
Four functions compressed into one click:
Factual verification: Are the underlying facts accurate? ABA Opinion 512 requires lawyers to independently verify AI-generated citations — approving a summary doesn't qualify.
Policy conformity: Does this action fall within permitted scope? COSO treats compliance checking as a control objective separate from factual accuracy.
Authority to commit: Does the person clicking have standing to bind the organization? Federal procurement rules require unauthorized commitments to be ratified by a specifically authorized official.
Responsibility for loss: Who absorbs the consequence when the outcome is wrong? The UK FRC's 2026 guidance distinguishes a bad output from inappropriate tool use from a method that fails professional standards even when the conclusion is correct.
In any other context, these would involve different people, different processes, or both.