June 2026 · 6 min read · Part 3 · Wiring the Agentic Enterprise
An agent that acts needs an undo.
Two posts made the agent's reading trustworthy across the lake and the integration plane. But a trustworthy read is only permission to recommend. The moment the agent acts, whether it pauses a renewal or issues a credit, it becomes an actor in your business, and an actor needs a scope of authority, a logged rationale, and an undo. Here is the write path the bridge was leading to.
Part 2 ended on a quiet promise. The bridge is a definition you can call, an identity you can resolve and revise, a meaning you can version. Build it once, and it stops mattering where the agent is standing. The agent reads the same governed “account at risk” whether the data is at rest in the lake or moving past it on the integration plane.
That was two posts spent making the agent’s reading trustworthy. Reading was never the point.
Go back to the start of all this. An agent is not a chatbot because someone acts on what it says. We built the bridge so the agent could read a trustworthy “account at risk” anywhere. Now it does the thing it was built to do. It pauses the renewal.
That sentence is where everything we governed so far gets spent. And it is a different kind of problem than the one the bridge solved.
Reading is reversible. Acting isn’t.
A wrong read costs you a wrong answer. You re-query and move on. The offline and online stores, the bounded skew, the overnight reconciliation, the whole apparatus of Part 2 works because data has the luxury of eventual consistency. The lake can decide tomorrow that today’s read was wrong, and the read costs nothing once it is corrected.
An action does not get that luxury. When the agent pauses the renewal, the email did not go out. The account team got paged. The customer’s experience changed in the window between the act and the correction. You cannot reconcile an email that already sent. Everything in this series so far made the agent’s inputs trustworthy. The write path is about governing its outputs, and outputs touch the world before you get to check them.
An action needs an authority, not just a confidence score.
Part 2’s last test was confidence. High-confidence perishable signal, act at the edge; low-confidence, tell a human. That test is about whether the read is right. It says nothing about whether the agent is allowed to take this action, or how large the action is.
An agent can be ninety-nine percent sure the renewal should pause and still have no business pausing a four-million-dollar enterprise renewal on its own. Confidence governs the read. Authority governs the act. They are different grants and you need both. Authority is a scoped permission: which actions, on which entities, up to what magnitude, and the line above which a human signs. This is the boundaries problem from “What an Agent Is,” landing on the act side, where it bites. The boundaries are the hard part. Not what the agent may know. What it may do.
Tier the action by what it costs to be wrong.
The deskilling post said to sort your pipelines by one question: what does a confident, silent, wrong answer cost here. Sort your agent’s actions the same way.
Reversible and low-stakes: add a note to the account, flag the deal for a human to look at. Let those run unattended. Irreversible or high-stakes: issue a credit, pause a renewal that matters, change a price. The agent proposes and a person with the authority disposes.
I have watched teams put a human in front of every action and call it caution. It is not caution. It is latency, and the people doing the approving learn to stop reading. That is a rubber stamp dressed as a control. Gate nothing, and you have authorized an actor you cannot answer for. Put the human where the cost of being wrong justifies the delay, and nowhere else.
The action has to carry its reasons, not just its result.
When the agent pauses the renewal, the record cannot only say “renewal paused.” It has to say why: paused because this entity read as account at risk, on these three escalation events, resolved to this account at this confidence, under this authority. That is the lineage discipline the lake already runs, applied to actions instead of tables.
This is not paperwork. Part 2 told us the edge resolves identity provisionally and the lake may revise it overnight. When the lake reconciles and finds the three tickets came from three different customers, you have to walk back every action that fired on the bad resolution. You can only do that if each action recorded what it believed and why. An action with no logged rationale is an action you cannot safely undo, because you cannot tell which ones were built on the resolution that just got corrected.
Build the undo before you build the act.
Part 2 named the options for when the planes disagree: reverse, flag, or escalate. The reverse path is not free and it is not always available, and you decide which before you ship the action, not after it fires wrong.
Some actions reverse cleanly. Un-pause the renewal, retract the internal alert, nobody outside the building ever knew. Some do not. The apology credit already hit the customer’s statement. The re-routed shipment is on a truck. For the actions that cannot be taken back, the gate moves earlier by definition, because there is no later. That is the class that needs the human in front of it, not because the agent is less accurate there, but because being wrong there has no undo to lean on.
So the test for whether an agent can act on its own is not “is it accurate.” It is “if it is wrong, can I take it back, and what does taking it back cost.” Accuracy you can improve. An action you cannot reverse, you can only prevent.
The bridge carried the meaning. The write path carries the consequence.
Part 1 said the semantics should travel. Part 2 said how. Both made the agent’s reading trustworthy across the lake and the integration plane, and that was real work worth doing. But a trustworthy read is permission to recommend. Acting is a different grant entirely.
An agent that recommends is a tool. You can read its output and ignore it. An agent that acts is an actor in your business, and an actor needs what every actor needs: a scope it operates within, a record of what it did and why, and a way to be overruled and undone. Build those and you can let it act. Skip them and you have not deployed an agent. You have authorized one and kept calling it a tool, and you will learn the difference the first time it pauses the wrong renewal.