Anyone deploying autonomous AI agents in business or high-trust workflows can no longer make do with the assumption that a single system 'simply does its job'. A clear line emerges from recent studies and governance frameworks from 2025 and 2026: separation of duties in agentic AI is no longer an elegant design option, but a condition for safety and accountability. The core point is that no single agentic path should allow all effective powers — data access, analysis, approval and execution — to fall into one hand.
Three sources together form that line: an academic autonomy framework, an engineering guide for agent workflows and an exploratory note from the French regulator CNIL together with the Conseil de l'IA et du numérique (CIANum). They approach the same issue from governance, architecture and data protection.
Autonomy is a design decision, not a property
The framework A Governance Framework for Agentic AI Autonomy Levels introduces a distinction that directly touches on separation of duties: Allowed Autonomy Levels (AAL) versus Autonomous Capability Levels (ACL). What an agent technically can do (ACL) is something other than what an organisation lets it do independently per workflow (AAL). Autonomy thereby becomes an explicit, documentable choice: which tasks may an agent carry out independently, which fall under human oversight, and how does that differ from the technical capabilities of the system?
This split ties in with the classic principle of separation of duties. An agent may technically do a great deal, but per workflow it is granted a bounded autonomy level that determines whether it only prepares, may also analyse, or may only execute after human or policy-based approval. In this way the degree of permitted autonomy becomes a governance object that stands apart from the raw capability of the model.
Architecture: single-responsibility agents and separated layers
Where the autonomy framework provides the why, A Practical Guide for Designing, Developing and Operating Agentic AI Workflows provides the how. The guide describes nine best practices for production agent workflows, including single-tool and single-responsibility agents, a clean separation between workflow logic and tool servers, and external management of prompts and policies.
The underlying idea is consistent with the governance layer: by strictly separating tasks and technical layers, you prevent one agent from holding data access, analysis, approval and execution all in its own hands. Each agent does one thing; the logic that strings steps together stands apart from the tools that carry out the steps; and policy is not hidden inside the agent itself but evaluated externally. That operationalises separation of duties at the architecture level and limits how far an error or misuse can spread through a chain.
The data protection angle: CNIL and CIANum
The exploratory note from CNIL and CIANum, announced in IA agentique et données personnelles, names four central risk domains of agentic AI: persistent memory layers, error cascade, unclear controller/processor roles and complex multi-service chains. The proposed mitigations come down to separation: partitioning of agent memory per process, sandboxing, a risk-tiered classification of actions with mandatory human approval for high-risk steps, and traceable reconstruction of entire workflows.
The analysis French CNIL Publishes Note on Agentic AI and Data Protection from Inside Privacy clarifies that the note creates no new obligations, but does give a direction: traceability of complete decision workflows — which personal data, which agents, which external services and in what chronology — plus technical measures such as per-agent and per-process memory partitioning, sandboxing and a kill switch accessible to the user. Translated into practice: which agent may see which data, who may authorise actions, and how is it recorded which autonomous step was carried out by whom or what?
Three layers that together form separation of duties
The sources together point to three coherent elements. First, a formal autonomy and role model in which it is laid down per agent and task what may be done independently and what falls under oversight. Second, an architecture with single-responsibility agents, separate identities and policy engines that separate decision preparation from decision release. Third, a governance and logging layer that can show which agent or human took which step, with which data and under which authorisation.
Where a verification console fits
Within this structure there is room for a verification layer that makes the division of tasks visible without itself setting the norm. IamVera.ai is such a verification layer for professionals working with confidential or high-trust information — not a chatbot and not its own language model. Vera can route a task through selected independent AI models and thereby make verification steps, corrections, disagreements and sources visible for inspection. That supports control and gives more insight into who prepared what and who released it, while the professional final judgement over correctness and completeness stays with the user, and it is not proof that every autonomous action can be fully reconstructed.
For workflows with sensitive documents, the relevant architecture is the one that ties in with the compartmentalisation that CNIL and CIANum propose. The Semantic Privacy Shield can replace sensitive values before AI processing on EU infrastructure with synthetic, session-only equivalents; the workflow is designed to send only anonymised content to the selected models, and is fail-closed: if the privacy verification fails, nothing is sent onward. Documents can be viewed and edited within the protected workflow via Vera Office, which runs on Collabora Online — not a Microsoft Office plug-in and no autonomous editing outside the user's control.
The professional final judgement remains with the user in all cases. The studies and the CNIL/CIANum note make clear above all that separation of duties in autonomous AI, as of 2026, has become an explicit, verifiable design variable — and that making that division visible is at least as important as drawing it up.