A replenishment agent does not keep your calendar. It watches sell-through, cross-references lead times, and raises a purchase order while your planners are still in the parking lot. That is the point of buying one. That is also the risk nobody priced into the business case.
So answer the question your auditors will eventually ask. When an agent commits two million dollars of inventory, who signed off?
In most retail deployments the answer is uncomfortable. Governance falls into an ownership vacuum. The business application team assumes cybersecurity is managing agent permissions. Cybersecurity assumes the business process owner defined the operational rules. Finance assumes the software vendor engineered the platform to prevent policy violations. By the time leadership asks who authorized the behavior, the system may have been running for months and making decisions nobody explicitly approved.
An audit log is not an approval
Here is the distinction that separates real governance from theater. Once money has moved or an unvetted contract term has been delivered to a client, an audit log can only document what happened. It cannot make the decision authorized.
Read that twice if you own a P&L. The agent can log every reasoning step, every tool call, every timestamp, and you still will not have an approval. You will have a very detailed record of a commitment no one signed. Access is governed; authority is not. Identity and access tools decide which systems an agent can log into. They are silent on the decision the agent then makes inside those systems: the renewal it commits to, the vendor it onboards, the refund it issues. Reachability is not authorization.
The scale problem makes this worse. A human approver works as a checkpoint when the volume is human. Agents act faster than oversight can keep up. A human approver is a natural checkpoint; an agent executing thousands of actions a day is not. Without an enforced limit and a defined escalation point, ‘the agent did it’ becomes the after-the-fact explanation for a commitment no one approved.
The three limits to set before go-live
Spend authority, thresholds, and escalation have to be written as code the agent obeys at the moment of action, with a named human owner per threshold. Three limits, specifically.
First, a per-order spend ceiling. A hard dollar cap on any single transaction. Above it, the agent escalates and holds. This is the pattern mature deployments already use: a procurement agent scoped to handle SaaS renewals up to $50K ACV, capped by standing conditions on price uplift, term length, approved vendor list, and geography. Translate that to replenishment. Cap per PO, per SKU class, per supplier.
Second, a cumulative velocity cap. A ceiling on total commitment across a rolling window. This is the limit most teams forget, and it is the one that produces the eight-figure headline. Agents don’t start over-privileged. They get there gradually, through a series of individually reasonable decisions. Twenty defensible orders in an hour still add up to a number your treasury team did not plan for.
Third, a named human owner per threshold band. Not a RACI chart, not a committee. One person, by title, who signs off above each line and whose name lands in the record. The sharpest question a board can put to its architecture team is exactly this: which named business leader owns and audits the operational rules governing each agent? If merchandising cannot answer today, that is your finding.
And the enforcement point matters as much as the rule. That is the only place where guardrails can intercept an agent action before it reaches an external system. Policies written in documentation cannot stop an agent from approving a vendor payment or sending a customer-facing communication. Enforcement at the point of execution is what separates governance from governance theater.
Where the CODN math actually lands
The Cost of Doing Nothing runs in two directions here, and boards keep pricing only one of them. Manual replenishment bleeds margin through stockouts, carrying cost, and markdown exposure. That number is real and it is why you are funding agents in the first place. The second CODN is ungoverned autonomy: capital committed outside policy, a SOX-relevant control gap, and a CFO holding a receipt nobody can trace. When AI judges that a large software contract should be approved and clears it without the right authority, the business has authorized spend it should never have approved and created the exact control failure that a SOX audit is built to catch.
The mistake is treating this as a reason to keep a human on every order. That does not scale and it throws away the margin you bought the agent to capture. Mandating that human employees approve every automated action does not solve this problem at enterprise scale.
The agents that survive a business case are the bounded ones. Clear ceiling, cumulative cap, named owner, enforced in code. Fund those. The ones your team cannot put a name against are not production-ready. They are policy you have not written yet. Write it before you scale, because the agent is already faster than the approval chain you have today.