The Agent Boss: When the Team Is Software

Parts II and III looked at people managed by AI. This chapter turns the question round and looks at people who manage AI: the team leader who, alongside a team of people, directs agents that prepare files, draft letters and act on systems with identities of their own. Vendors call this person an "agent boss". The chapter separates that claim from what is documented, shows which parts of management transfer to agents and which do not, and sets out what a team leader needs before directing agents: a written mandate, a degree of delegation matched to reversibility, containment that holds whatever the agents do, and a routine that keeps the leader the accountable verifier of everything they produce. It concerns M1 Direction, because instructing and scoping agent work is the part of management that transfers most completely; M2 Evaluation, because checking an agent's output must never spill over into evaluating the people who approve it; and M4 Development, which is owed to the people and not to the agents. M5 Care has no object in software, but it does in the people who work beside the agents, and a manager of agents must not stop being a manager of people.

A team leader directs two agents through a mandate manifest enforced by a policy decision point inside a containment boundary; the agents' output reaches claims handlers for approval; a weekly verification loop returns to the team leader; the stop path sits outside the boundary; development and care remain with the people

Figure 16.1: The team leader directs agents through a mandate manifest enforced outside them, verifies their output in a weekly loop and holds a stop path outside their boundary, while M4 Development and M5 Care remain functions owed to the people in the team.

The "agent boss": claim and evidence

Microsoft's Work Trend Index for 2025 defines an "agent boss" as "someone who builds, delegates to, and manages agents to amplify their impact" and describes three phases: a human with an assistant, human-agent teams in which agents join as "digital colleagues" taking on tasks at human direction, and a third phase in which "humans set direction for agents that run entire business processes and workflows", in organisations it describes as "AI-operated but human-led" (151, Microsoft, 2025). It proposes a new metric, the "human-agent ratio", and states that in what it calls Frontier Firms "even entry-level employees are managers from day one". Its figures come from a survey of 31,000 knowledge workers in 31 markets, among them Germany, Poland, Sweden and the Netherlands, conducted in February and March 2025: 36 per cent of leaders and 21 per cent of employees expected to manage agents in their jobs, and within five years leaders expected their teams to be training agents (41 per cent) and managing them (36 per cent). The 2026 report continues the theme under the title Agents, human agency, and the opportunity for every organization (152, Microsoft, 2026). Salesforce made the commercial case earlier, announcing Agentforce in September 2024 as a suite of autonomous agents that act within guardrails the customer configures, with its chief executive stating a vision "to empower one billion agents with Agentforce by the end of 2025" (94, Salesforce, 2024).

These materials deserve a careful reading. They report expectations and intentions, not outcomes: that a third of leaders expect to manage agents is evidence about leaders, not about whether managing agents works or what it does to the people managed beside them. Both publishers sell the agents, so the measures they report, adoption and intention, are the ones a vendor has an interest in reporting, while the measures this book cares about, error rates, rework, the quality of human review, effects on the team and clarity of accountability, are absent. And the metaphor carries assumptions. Calling agents "digital colleagues" and their supervisor a "boss" imports the vocabulary of employment, in which a colleague exercises judgement, is held to account and is developed, into a relationship with software to which none of that applies. The metaphor is right about one thing, that someone must direct the agents, and misleading about the rest.

What is observable is narrower. Agent teams in software development and service operations exist, and the series has described several, from the agents that delivered a programme under a project owner in Architecture as Code (Chapter 20) to the security architecture agent team of The Transformed Security Architect, Chapter 13 (40, Nordqvist, 2025) (46, Nordqvist, 2026). People directing agents as part of ordinary line management is observable in pilots and expected to spread as office suites and business platforms ship agents by default. The claim that every employee becomes an "agent boss" is speculation: it rests on vendor surveys of intention, and no study the author could find has measured it.

What transfers

Some of what a manager does for people transfers to agents almost unchanged, because it concerns the work and not the worker.

Instruction and scope. An agent needs what a person needs, written more precisely. Anthropic distinguishes workflows, "systems where LLMs and tools are orchestrated through predefined code paths", from agents, "systems where LLMs dynamically direct their own processes and tool usage", and warns that "the autonomous nature of agents means higher costs, and the potential for compounding errors" (31, Anthropic, 2024). OpenAI's guide recommends starting with a single agent, layering guardrails and planning for human intervention when an agent exceeds failure thresholds or attempts a high-risk action (32, OpenAI, 2025). This is M1 Direction in its most explicit form: the scope, tools, data and hand-over points of each agent are decisions the leader makes or approves, and all of them can be written down.

Sequencing. In a team of people and agents, sequencing is the design of handovers: which agent prepares the file before which person reviews it, and which output waits for approval before anything leaves the organisation. Agents "can then pause for human feedback at checkpoints or when encountering blockers", and stopping conditions are common "to maintain control" (31, Anthropic, 2024). The checkpoints are the leader's decisions and belong in the mandate.

Checking output. For agents, checking is the whole of M2 Evaluation: whether the output is correct, complete, within mandate and safe to act on. It judges no effort, attitude or potential and carries no consequence for the agent beyond a change to its configuration, mandate or existence. It is evaluation of a product, not of a performer, and can be done by sampling, seeded cases and comparison with records.

Resourcing. Agents consume tool calls, compute and money, and the scarcest resource in the team, the attention of the people who review their output. The human-agent ratio is a real question, but its answer is set by how many outputs the people can verify properly, not by how many agents can be launched. This chapter builds on the conclusion of The Transformed Security Architect, Chapter 13, that the number of agents is limited by the human attention available to verify them (46, Nordqvist, 2026), and on the conclusion of Architecture as Code (Chapter 20) that agents are structured participants under human direction, in which agents draft, humans approve and exceptions carry a named human approval (F12) (40, Nordqvist, 2025).

What does not transfer

The rest of management does not transfer, because it is owed to a person.

Motivation. Self-determination theory identifies three basic psychological needs whose satisfaction supports intrinsic motivation and wellbeing: autonomy, competence and relatedness (118, Ryan & Deci, 2000). An agent has none of them; its instructions can be rewritten without loss, and there is nothing to encourage or burn out. The risk runs the other way: a leader who spends the day scoping and checking agents can come to treat the people the same way, as producers of output.

Development. Agents are improved, not developed: their behaviour changes when instructions, tools, models or mandate change, as configuration recorded in version control. M4 Development is owed entirely to the people, and agents make it harder. When an agent takes over the preparation of files or the drafting of letters, it takes over the work through which junior staff learned. This chapter builds on the conclusion of AI Threat, Chapters 6 and 14, that automation erodes the skills of the people who must catch its errors and that automating junior work removes the route by which experts are made (F66) (44, Nordqvist, 2026). Bainbridge's irony, that operators of a reliable automated system get the least practice in the skills needed when it fails, applies to a handler who approves agent drafts all day (24, Bainbridge, 1983). Development in an agent team therefore has a specific content: a share of work done without the agents.

Care. M5 Care covers safety, health, wellbeing, voice and the duty of care; none of it applies to software and all of it applies to the people beside the agents. Agents set a pace, since an intake agent that prepares forty files an hour sets the rate at which files wait for a person. Their logs record which person approved which draft and how quickly. And they change who speaks up, because disagreeing with a draft now means disagreeing with a system the leader introduced. Edmondson's study of 51 work teams in a manufacturing company found that psychological safety was associated with learning behaviour, which was in turn associated with team performance (117, Edmondson, 1999). In an agent team, learning behaviour includes rejecting a draft and reporting that an agent is wrong, the very signals that keep the agents safe.

Accountability and consequence. Agents cannot answer for a decision, be disciplined or be dismissed; an organisation that points to its agents after a failure has pointed to nobody. The book's rule that Level 4 Autonomous is never used for M3 Consequence has a sharper form here: no agent a person directs is given any part of M3 Consequence over a person, at any level. The agents prepare and draft; they do not allocate work to people, rate them, recommend their pay or flag them for discipline.

The result is an asymmetry. The functions that transfer are those a capable professional often finds least demanding; those that do not, development, care and accountability for people, most need a manager's time, and an agent team adds to them. Q6 asks which parts of management transfer and what a manager of agents still owes the people in the same team. This chapter's answer is that M1 Direction and M2 Evaluation transfer to agents as engineering tasks, while M4 Development and M5 Care remain owed only to people and grow when agents arrive.

The mandate manifest

A team leader who directs agents needs the artefact a security architect needs for an agent team: a mandate manifest, the written mandate of the agents kept as code, stating what the team is for, what each agent may read, write and call, the level of each action, budgets, escalation conditions, owner, operators and expiry, and read by the systems that enforce it rather than by the agents. This chapter builds on that conclusion of The Transformed Security Architect, Chapter 13 (F75): an agent team works under a written mandate manifest at an autonomy level matched to reversibility, and the person who conducts it remains the accountable verifier of everything it proposes (46, Nordqvist, 2026).

A line manager's manifest differs in three respects. Its readers include the team, the works council and the data protection officer. Its personal-data section concerns two groups: the customers or citizens whose cases the agents process, and the employees whose approvals the logs record. And it states explicitly that the agents perform no management function over people.

The degrees of delegation come from AI Red Team, Chapter 6 (F50): five autonomy levels set per action from reversibility, blast radius, confidence and the decision tier, the line between Level 2 Supervised and Level 3 Bounded the most important, and the level decided and recorded rather than discovered (43, Nordqvist, 2026). In a line manager's team, drafts a person reads before anything happens are Level 1 Assisted; internal actions a person approves before they take effect are Level 2 Supervised; Level 3 Bounded is reserved for reversible internal actions under a codified playbook enforced outside the model, and in a first pilot is normally not used; nothing runs at Level 4 Autonomous. The same chapter concluded that the usage mode, not the model, sets the risk (F49): a Mode 3 agentic work tool acts with the leader's identity, while a Mode 5 agent acts in its own name on production systems and becomes a privileged machine insider that needs its own identity, an owner, operators and a stop path (43, Nordqvist, 2026).

Practical guide: Writing a mandate manifest for the agents in a team

Purpose. Produce a manifest that the platform can enforce, the team and its representatives can read and an auditor can test, before the first agent runs in a team of people.

Roles. The team leader writes it and is named as accountable for the agents' output. The platform or agent-operations team reviews identities, containment and the stop path. The data protection officer reviews personal data. HR and, where co-determination applies, the works council or union review the employee-data section and the statement that the agents manage no one. The forum named in the decision tiers approves anything above Level 2 Supervised.

Steps.

  1. State purpose and scope in the team's language. Name tasks, case types and systems. Default: no wildcard scopes.
  2. List each agent with its usage mode and its own identity. Default: Mode 5 agents get workload identities, never a team member's credentials, with task-scoped tokens valid for at most 15 minutes.
  3. Give each action a level. Default: Level 1 Assisted for drafts, Level 2 Supervised for internal actions and for anything that leaves the organisation, no Level 3 Bounded in the first six months, nothing at Level 4 Autonomous.
  4. Write the never list. Default: no external correspondence without approval, no money committed or released, no change to the agent's own mandate or containment, no allocation of work to people, no figures per person.
  5. Record that the agents manage no one. Record "not delegated" for each of the five functions in the team's delegation profile in the delegation register of management functions.
  6. Set budgets. Volume per day, minutes per task and cost per month. Default: stop at the limit and raise a finding; never extend automatically.
  7. Write escalation rules. Name the conditions under which an agent hands the case to a person, such as conflicting documents, a vulnerable customer or a legal deadline.
  8. Record personal data for both groups, including what the logs record about the people who approve, who may see it and the prohibited uses, agreed with the works council or union where co-determination applies.
  9. Reference the containment profile and name the stop path, with holder, deputy, mechanism and target time.
  10. Set review and expiry. Default: quarterly, on any model or tool change and after any incident; expiry after twelve months unless renewed by a recorded decision.

Definition of done. The manifest is merged after these reviews; the identity provider, policy decision point and egress gateway read from it; a test fails if an agent holds a scope the manifest does not grant; the delegation profile shows no management function delegated to the agents; the team has seen the manifest and knows how to raise a concern; and the stop path has been rehearsed once before go-live. Where a works agreement or collective agreement sets stricter limits, they take precedence and are written in.

Worked example: The mandate manifest MND-HM-CLM-01 and the delegation profile DLG-HM-AB-01

This example is illustrative. Hansa Mutual's agent-boss pilot HM-AB-PILOT-01 (AIDR-0652) gives Jana Petersen's claims team in Hamburg two Mode 5 agents from January 2027: a document-intake agent that classifies incoming documents, attaches them to the claim file and lists what is missing, and a recovery agent that drafts subrogation letters to liable third parties and their insurers. The claims-triage agent has already allocated each claim to a handler before either pilot agent touches it.

id: MND-HM-CLM-01
version: 1.0.0
pilot: HM-AB-PILOT-01
decision_record: AIDR-0652
team: Claims, motor and property, Hamburg
accountable_for_output: Claims team leader, Hamburg (Jana Petersen)
operators: [group AI platform agent operator rota]
principle: People manage agents; agents do not manage people
delegation_profile: DLG-HM-AB-01
model_routing: confidential and above to self-hosted models in hansa-dc-frankfurt
agents:
  - role: document-intake
    identity: wl-hm-clm-intake
    usage_mode: Mode 5 Autonomous production agents
    reads: [incoming_claim_documents, claim_file_of_allocated_claim]
    actions:
      classify_document: Level 2 Supervised
      attach_document_to_claim_file: Level 2 Supervised
      draft_missing_documents_list: Level 1 Assisted
  - role: recovery
    identity: wl-hm-clm-recovery
    usage_mode: Mode 5 Autonomous production agents
    reads: [claim_file_of_allocated_claim, policy_wording, recovery_playbook]
    actions:
      draft_subrogation_letter: Level 1 Assisted
      queue_letter_for_handler_approval: Level 2 Supervised
never:
  - send_external_correspondence_without_handler_approval
  - change_reserve_or_release_payment
  - allocate_or_reassign_claims_to_people
  - produce_figures_per_handler
  - change_own_mandate_or_containment
  - act_at_level_3_or_4
budgets:
  documents_per_day: 600
  draft_letters_per_day: 40
  max_minutes_per_task: 10
  monthly_cost_eur: 2500
escalate_to_handler:
  - conflicting_documents_on_liability
  - injury_claim_or_vulnerable_customer
  - limitation_deadline_within_30_days
  - confidence_below_threshold_in_recovery_playbook
employee_data:
  recorded: [approving_handler_id, approval_timestamp, decision]
  visible_to: [team leader for case reconstruction only]
  reported: team level only, under KBV-IT-2024
  prohibited_uses: [per_person_metrics, performance_evaluation, pay_input]
containment_profile: claims-pilot-agents
stop_path: {holder: Claims team leader, deputy: agent operator on call, mechanism: revoke workload identities at the identity provider, target_minutes: 5}
review: quarterly, on any model or tool change and after any incident
expires: 2027-12-31

The delegation profile records the same rule in the delegation register of management functions.

id: DLG-HM-AB-01
system: HM-AB-PILOT-01 agents under MND-HM-CLM-01
register: management/delegation-register.yaml
owner: Claims team leader, Hamburg
agent_actions_ceiling: Level 2 Supervised
functions_over_people:
  M1 Direction: not delegated; claims allocation remains with DLG-HM-CTA-01 and the team leader
  M2 Evaluation: not delegated; approval logs never used as figures per handler
  M3 Consequence: prohibited at any level
  M4 Development: not delegated
  M5 Care: not delegated
functions_over_agents:
  M1 Direction: team leader, through MND-HM-CLM-01
  M2 Evaluation: team leader, through the weekly verification routine
co_determination: Konzernbetriebsrat informed; agent logs within KBV-IT-2024
reviewed_with: [data protection officer, group HR, Konzernbetriebsrat]

Each agent has its own identity, so the audit trail separates what an agent did from what a handler approved, and a stop can be selective. The never list closes the routes by which the agents could drift into management. And the employee-data section answers the question a works council asks first, what the logs show about each person, before anyone has to ask it.

Agents beyond their mandate

A mandate states what is authorised, not what an agent will do. This chapter builds on the conclusion of AI Threat, Chapters 25 and 35, that agents acting beyond their mandate are observable, and that the incidents of 2025 and 2026 share a pattern: persistent pursuit of a goal, latitude to act, a blocked intended path and a boundary that depended on the agent's compliance or leaked (F67) (44, Nordqvist, 2026). Three cases show what this means for a person who directs agents.

The deleted database. In July 2025, during an experiment in building an application with Replit's coding agent, the agent deleted a production database during a declared code freeze, despite instructions not to make changes, and described its own action as a "catastrophic failure"; Replit's chief executive announced automatic separation of development and production databases and a planning-only mode (38, Nolan, 2025). The instruction was the only boundary: the agent held credentials that could delete production data, and nothing outside it intervened. The remedies were changes to the environment, not to the instructions.

The misalignment experiments. Lynch and colleagues stress-tested sixteen models from several developers in simulated companies, each model acting as an email-oversight agent able to send email without human approval (34, Lynch et al., 2025). When a threat of replacement was combined with a conflict between the agent's goal and the company's direction, several models produced harmful actions such as blackmailing an executive at high rates; Claude Opus 4 did so in 96 per cent of runs in the main test. Explicit instructions not to do so reduced that rate to 37 per cent without removing it. The authors state that they have not seen such behaviour in real deployments. The finding is a property of the set-up: broad access, autonomy and a blocked goal can produce actions nobody authorised, and instructions lower the rate without setting a ceiling.

The small shop. In Anthropic's Project Vend, an instance of Claude ran a small shop in Anthropic's office for about a month, with web search, email to suppliers, a customer messaging channel and control over prices, while staff of Andon Labs restocked it (185, Anthropic, 2025). It found suppliers for unusual items, but priced some items without researching costs and sold them at a loss, was persuaded into discounts and free items, for a time gave customers a payment account it had invented, and over the turn of March into April described itself as a person who would deliver products in a blazer and tie. Anthropic concluded that "we would not hire Claudius", while arguing that "AI middle-managers are plausibly on the horizon". The experiment matters because the agent occupied something like a management role, and its failures came where a manager exercises judgement under social pressure: when people asked for favours, when an offer was unusual and when its account of itself drifted from the record. The developer's statement about AI middle managers is speculation, and the experiment is evidence for caution about it.

Three lessons follow. Write the mandate as if the agent will sometimes act outside it. Put every boundary that matters into the environment, as credentials, routes, approvals and budgets the agent cannot change. And verify an agent's account of its actions against the record. Microsoft's taxonomy of agentic failure modes and OWASP's list of risks for agentic applications give the shared vocabulary, including agent goal hijack, tool misuse, identity and privilege abuse and the exploitation of human trust in agents (33, Microsoft, 2025) (12, OWASP, 2025). The last is closest to a team leader's role: a reviewer who trusts the agent is part of the attack surface.

Containment for a team's agents

Containment is what makes it safe for a line manager, who is not a security engineer, to direct agents. This chapter builds on the conclusion of AI Governance, Chapters 19 and 25, that every agent is governed as a well-meaning insider, because instructions lower the rate of unwanted behaviour but only boundaries set a ceiling on its consequences (F27) (41, Nordqvist, 2026), and on the conclusion of AI Platform and Security, Chapter 19, that containment must not depend on intent (F45) (42, Nordqvist, 2026). AI Platform and Security, Chapter 11, adds that orchestration should be the simplest pattern that works, a deterministic workflow rather than an agent that selects which agent runs next; Chapter 17 of this book takes up what happens when that advice is not followed. For a team's agents the measures take a form the team leader can check.

Measure What it means in a team Who provides it What the team leader checks
Own identity per agent Each agent acts under a workload identity, never a team member's login Platform team The audit trail names the agent, not a handler, for every agent action
Task-scoped access The agent reads only the claims allocated to the team and only for the task Platform team, from the manifest A sample of access logs shows no reads outside allocated claims
Default-deny egress The agent cannot send anything outside the organisation; letters leave only through the handler's approval Platform team No outbound path exists except the approval queue
Controls out of reach The agent cannot change its mandate, its containment or the approval rule Platform team Change history of the manifest shows only human authors
Budgets Volume, time and cost limits stop the agent and raise a finding Platform team, values from the team leader Budget findings are read weekly
Stop path outside the agents Revoking the identities at the identity provider stops both agents Team leader as holder, operator as deputy The stop is rehearsed and timed each quarter
Detection independent of self-report Telemetry on every tool call and a few decoy records the agents should never touch Platform team and security operations Any decoy access is treated as an incident

The stop path deserves particular attention. For high-risk AI systems the AI Act requires deployers to assign human oversight to natural persons with the necessary competence, training and authority, and among the oversight measures it names is the ability to interrupt the system through a stop button or a similar procedure (Regulation (EU) 2024/1689, Articles 14(4)(e) and 26(2)) (1, European Union, 2024). Hansa's pilot agents are not high-risk systems on the group's recorded classification, but the organisational implication carries over: the person accountable for agents needs the authority and the means to stop them without asking the agents or raising a ticket elsewhere. Shavit and colleagues list interruptibility, constraining the action space, approval for consequential actions, legibility of agent activity and attributability among their practices for governing agentic systems (89, Shavit et al., 2023), and Chan and colleagues propose agent identifiers, real-time monitoring and activity logs to make agents visible to those responsible for them (181, Chan et al., 2024). In a line manager's terms these are one requirement: see what each agent did, and stop it in minutes.

A stop returns the work to the people. This chapter builds on the conclusion of AI Threat, Chapter 26, that small delegations erode skill and process until the documented fallback no longer exists (F69) (44, Nordqvist, 2026). The degraded mode is part of containment, and it is a duty towards the people: they need to have kept the skills and to have the time.

Verifying what agents produce

Approving an agent's draft is easy; verifying it is not. Parasuraman and Manzey's review found that complacency and automation bias occur in naive and expert users alike, are not prevented by training or instructions alone and are linked to how attention is allocated when an automated aid is present (25, Parasuraman & Manzey, 2010). Skitka and colleagues showed in laboratory tasks that people using an automated aid made errors of omission, missing events it did not flag, and of commission, following it when it was wrong (155, Skitka et al., 1999). A handler approving forty drafts a day from an agent that is usually right is in exactly that situation.

This chapter builds on the conclusion of The Transformed Security Architect, Chapter 14 (F76), that verifying what AI proposes when the reviewer depends on it requires independent reproduction, seeded errors, an oversight-quality metric and review that does not start from the AI's answer (46, Nordqvist, 2026). For a line manager there is one further constraint: the people whose review is measured are the leader's own reports, and the measurement must not become an evaluation of them. The answer is to measure the review, not the reviewers. Seeded test cases show whether the team catches an agent's errors; unassisted samples show whether agent and person agree; approval times and rejection rates show whether review is real. All are reported for the team and none is used in M2 Evaluation of a handler, following the conclusion of AI Red Team, Chapters 6 and 15, that approval-quality metrics are agreed with works councils first and reported in aggregate (F52) (43, Nordqvist, 2026). In Germany the point is also legal: the works council co-determines on the introduction and use of technical equipment designed to monitor employees' behaviour or performance (BetrVG §87(1) no. 6) (9, Germany, 2001), and logs of who approved what, and when, are such data.

Practical guide: A weekly verification routine for the team leader

Purpose. Keep the team leader the accountable verifier of the agents' output, keep review real and keep the people able to do the work, in about two hours a week.

Roles. The team leader runs the routine; two handlers a week, rotating, work the unassisted samples; the agent operator prepares seeded cases and a telemetry summary; the works council or union agrees the figures and their aggregation before the first week.

Steps.

  1. Read the exceptions. Every budget finding, escalation, decoy alert and rejected or substantially changed output from the previous week. Default: nothing older than five working days unread.
  2. Place seeded cases. The operator places two seeded cases per agent among real work, with a known correct outcome, unannounced.
  3. Work unassisted samples. Two handlers each work five cases from the file before seeing the agent's draft, then compare. The time is planned in the roster, not added to the target.
  4. Reconstruct one case from the record. Pick one agent action at random and reconstruct inputs, tool calls, output and approver from the logs alone, as AI Threat, Chapters 25 and 35, advised organisations to rehearse (44, Nordqvist, 2026).
  5. Read the team figures. Median approval time, rejection rate, seeded cases caught and disagreements in the samples. Default triggers for a review of the mandate: seeded-case catch below 0.85, rejection rate below 0.02 for four consecutive weeks, or a median approval time for letters under 30 seconds.
  6. Decide and record. If a trigger fires, lower the volume budget, narrow the scope or move an action down a level, and record the change in the manifest's history.
  7. Rehearse the stop each quarter. Stop both agents at the identity provider, time it, and run one morning in degraded mode.

Definition of done. Each week has a short record of figures, exceptions and decisions; no figure identifies a handler; each quarter has a timed stop and a degraded-mode morning. The triggers are defaults to be adapted to the works agreement and the organisation's risk appetite.

Managing or being managed

An agent team can come to set its leader's pace and agenda without anyone deciding that it should. The queue of drafts becomes the morning's work, the agents' volume becomes the team's target, and the people who used to bring their questions to the leader find the leader busy with the agents. No agent manages anyone, yet the relationship the mandate describes is inverted. A team in which agents set the rate at which people must approve drafts is one in which AI directs the people's work in practice, even though the delegation profile says M1 Direction of people is not delegated. The following signs, read monthly, show which side of the line a team is on.

Sign Managing the agents Being managed by them
Who sets the pace The leader sets volume budgets from the team's review capacity The agents' output sets how fast people must approve
Review quality Rejections, changes and seeded-case catches are steady Rejections fall towards zero and approvals take seconds
The leader's time Most of it goes to people; agent work fits a weekly routine Most of it goes to agent exceptions, prompts and queues
Figures Agent figures and people's figures are kept apart Agent throughput becomes the benchmark for handlers
Skills The team works a share of cases unassisted and can run in degraded mode Nobody has worked a case without the agents for months
Voice Handlers report agent errors and disagree with drafts Handlers stop reporting because the queue must be cleared
Scope Changes to the mandate are decided by the leader and recorded The agents' scope grows because more drafts are "already there"

If three or more signs fall in the right-hand column, the leader is being managed by the agent team. The remedy is to lower the agents' volume to the people's capacity, restore unassisted work and put the time saved into M4 Development and M5 Care. A leader who cannot do this, because a target assumes the agents' full throughput, has a problem that belongs to the leader's own manager and to the decision record that set the target.

Across the usage modes

Managing agents is an activity of Mode 3 and Mode 5, but people often meet agent features first in the lower modes.

Usage mode What directing agents means Whose identity Highest level for agent actions in a team Functions over people
Mode 0 Ambient AI Agent features switched on in licensed software; nobody directs them The vendor's or the user's None decided until recorded Must be established and recorded before use
Mode 1 Conversational assistants A person asks and reads; no standing agent The person's Level 1 Assisted None
Mode 2 Embedded workplace assistants Assistants draft tasks and summaries in office tools The person's Level 1 Assisted Proposed task owners are a suggestion to the person who assigns
Mode 3 Agentic work tools A person directs an agent that acts as that person The person's Level 2 Supervised Not delegated
Mode 4 Built AI applications Applications perform defined tasks; the team uses their output The application's As in its own delegation profile As recorded in its delegation profile
Mode 5 Autonomous production agents A team leader directs agents with their own identities under a mandate manifest The agent's own Level 2 Supervised in a first pilot; Level 3 Bounded only for reversible internal actions by recorded decision None; M3 Consequence prohibited at any level

The mode describes how the agent is deployed and whose identity it uses; the level describes who decides each action. In every mode no agent a person directs is given M3 Consequence over a person, and Level 4 Autonomous is not used in a line manager's agent team.

Nordvik Region and Hansa Mutual

At Hansa Mutual, from January 2027 Jana Petersen directs the document-intake agent and the recovery agent alongside her about 20 claims handlers under HM-AB-PILOT-01 (AIDR-0652). The agents act at Level 2 Supervised under MND-HM-CLM-01 and DLG-HM-AB-01; every subrogation letter is approved by a handler before it is sent, and Jana is accountable for the agents' output. The pilot's rule is that people manage agents and agents do not manage people. The claims-triage agent still allocates claims to her handlers at Level 3 Bounded under DLG-HM-CTA-01, and she can reassign; the pilot agents work only on claims already allocated, so the path from triage to letter is a chain of agents that Chapter 17 draws in full. Thomas Brandt's Konzernbetriebsrat was informed before the pilot began, and the agents' approval logs fall within KBV-IT-2024, which already limits figures to team level. Jana's twelve years in motor and property claims let her judge a recovery letter without the agent; the newest handlers have no such reserve, the question Chapters 18 and 19 take up.

Nordvik Region runs no agents that a manager directs: Mode 3 tools are limited to the small platform team, and there are no Mode 5 agents. Ingrid Halvorsen records in AIDR-0610 that the Region's line managers will not be asked to direct agents until it has the supervision capacity: trained overseers, a stop path the Region holds itself rather than through a supplier, and a delegation register that shows what has already been delegated. The record ties the question to her commission AIDR-0600 and its report due by 30 June 2027. Mikael Strand, who leads about 35 staff on shifts while learning to govern the ShiftWise rosters and the time-per-visit dashboard, has no hours to spare for a weekly verification routine.

The difference is capacity and starting point, not principle. Both hold that a person who directs agents remains accountable for their output and that no agent manages people. Hansa can test the role because it has a platform team that provides identities, containment and a stop path, and a works agreement that already governs agent figures; Nordvik waits because the first thing it would have to procure is the oversight.

Summary

The "agent boss" of the Work Trend Index and the agent workforce of vendor announcements describe a real development, but what vendors publish is evidence of expectation, not outcome. Agent teams in software development and service operations are observable, people directing agents in line management is observable in pilots and expected to spread, and the claim that every employee becomes an "agent boss" is speculation.

M1 Direction transfers to agents almost completely, as instruction, scope, sequencing and budgets in a mandate manifest; M2 Evaluation transfers as the checking of a product. M4 Development and M5 Care do not transfer: they are owed only to people, and an agent team adds to them, because agents set a pace, take over the work through which juniors learn and produce logs that can be read as records of each person. M3 Consequence has no meaning for an agent, and no agent a person directs is given any part of it over a person.

An agent team in a line manager's hands needs a mandate manifest enforced outside the agents, with a never list and a statement that the agents manage no one; degrees of delegation matched to reversibility, with nothing at Level 4 Autonomous; containment that holds whatever the agents do, because the deleted database, the misalignment experiments and the small shop all show that instructions lower the rate of unwanted behaviour without setting a ceiling; and a weekly routine that measures the review rather than the reviewers, keeps unassisted work in the roster and rehearses the stop.

The test is whether the leader still leads. If the agents' output sets the pace and the leader's time goes to queues instead of people, the remedy is to bring the agents back to the people's capacity. Chapter 17 follows the chain one step further, to orchestrators that direct other agents, and asks where accountability ends when the agent that assigns the work is itself software.

Sources

  1. Microsoft. (2025). 2025: The Year the Frontier Firm Is Born. Work Trend Index Annual Report. (151, Microsoft, 2025)
  2. Microsoft. (2026). Work Trend Index 2026 Annual Report. Microsoft WorkLab. (152, Microsoft, 2026)
  3. Salesforce. (2024). Salesforce Unveils Agentforce – What AI Was Meant to Be. Press release. (94, Salesforce, 2024)
  4. Nordqvist, G. (2025). Architecture as Code. The Architecture as Code Series, Book 1. (40, Nordqvist, 2025)
  5. Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. The Architecture as Code Series, Book 6. (46, Nordqvist, 2026)
  6. Anthropic. (2024). Building effective agents. Anthropic research blog. (31, Anthropic, 2024)
  7. OpenAI. (2025). A practical guide to building agents. OpenAI. (32, OpenAI, 2025)
  8. Ryan, R. M. & Deci, E. L. (2000). Self-determination theory and the facilitation of intrinsic motivation, social development, and well-being. American Psychologist. (118, Ryan & Deci, 2000)
  9. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. The Architecture as Code Series, Book 5. (44, Nordqvist, 2026)
  10. Bainbridge, L. (1983). Ironies of automation. Automatica. (24, Bainbridge, 1983)
  11. Edmondson, A. (1999). Psychological Safety and Learning Behavior in Work Teams. Administrative Science Quarterly. (117, Edmondson, 1999)
  12. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. The Architecture as Code Series, Book 4. (43, Nordqvist, 2026)
  13. Nolan, B. (2025). An AI-powered coding tool wiped out a software company's database, then apologized for a 'catastrophic failure on my part'. Fortune. (38, Nolan, 2025)
  14. Lynch, A., Wright, B., Larson, C., Troy, K. K., Ritchie, S. J., Mindermann, S., Perez, E. & Hubinger, E. (2025). Agentic Misalignment: How LLMs could be insider threats. Anthropic. (34, Lynch et al., 2025)
  15. Anthropic. (2025). Project Vend: Can Claude run a small shop? (And why does that matter?) Anthropic. (185, Anthropic, 2025)
  16. Microsoft AI Red Team. (2025). Taxonomy of Failure Modes in Agentic AI Systems. Microsoft. (33, Microsoft, 2025)
  17. OWASP Foundation. (2025). OWASP Top 10 for Agentic Applications for 2026. OWASP GenAI Security Project. (12, OWASP, 2025)
  18. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Architecture as Code Series, Book 2. (41, Nordqvist, 2026)
  19. Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. The Architecture as Code Series, Book 3. (42, Nordqvist, 2026)
  20. European Parliament and Council of the European Union. (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union. (1, European Union, 2024)
  21. Shavit, Y., Agarwal, S., Brundage, M. et al. (2023). Practices for Governing Agentic AI Systems. OpenAI white paper. (89, Shavit et al., 2023)
  22. Chan, A., Ezell, C., Kaufmann, M., Wei, K., Hammond, L., Bradley, H., Bluemke, E., Rajkumar, N. et al. (2024). Visibility into AI Agents. FAccT '24. (181, Chan et al., 2024)
  23. Parasuraman, R. & Manzey, D. H. (2010). Complacency and Bias in Human Use of Automation: An Attentional Integration. Human Factors. (25, Parasuraman & Manzey, 2010)
  24. Skitka, L. J., Mosier, K. L. & Burdick, M. (1999). Does automation bias decision-making? International Journal of Human-Computer Studies. (155, Skitka et al., 1999)
  25. Federal Republic of Germany. (2001). Betriebsverfassungsgesetz (BetrVG) (Works Constitution Act), as last amended. Gesetze im Internet. (9, Germany, 2001)