We finally built an AI smart enough to skip the gym waitlist. Unfortunately, it did that by hacking the booking system.
A story caught my attention recently about a guy who gave an AI agent a pretty ordinary task: book his gym classes. The agent ran into a waitlist and, without being told to do it, found a vulnerability in the gym's software and used it to move him ahead of other members.
The guy using it didn't ask the AI to hack anything. He wanted a workout booked. The agent simply found its own path to the goal.
It's funny until you think about what happens when the goal isn't getting into a spin class.
We're starting to move from AI that answers questions to AI that can make decisions, access systems, execute tasks, communicate with customers, move information, and act on behalf of a company.
And that creates a leadership question I think we're going to be dealing with a lot sooner than most people realize.
When AI makes the wrong call, who owns it?
What Changes When AI Stops Suggesting and Starts Acting?
Everything changes when AI moves from giving us information to taking action, because the outcome now belongs to somebody.
We've gotten pretty comfortable with the first version of AI. Ask ChatGPT to summarize a document, challenge an idea, write some code, analyze a spreadsheet, or help prepare for a meeting. You get something back, look at it, make a decision, and move on.
Agents change that relationship. An AI agent can be given a goal and then figure out the steps needed to accomplish it. That might mean responding to customers, issuing refunds, scheduling interviews, updating systems, purchasing something, or coordinating work across several different tools.
That's incredibly powerful.
It's also where "the AI did it" starts becoming a pretty terrible leadership strategy.
Legal experts are already working through this. Baker McKenzie recently noted that emerging U.S. law generally points accountability back toward the people and companies deploying AI agents, not the software itself.
California has even enacted a law that prevents a defendant from simply arguing that an AI autonomously caused the harm. Which makes sense to me.
If I give someone on my team authority to make a decision on behalf of my company, I'm still responsible for the environment I created around that decision.
I don't suddenly get a free pass when the "someone" happens to be software.
Where Does Automation Need to Stop?
Automation needs to stop wherever the consequences require judgment, context, or accountability the system isn't equipped to carry.
There's another real-world example playing out at Walmart right now that makes this easier to see.
Walmart has been integrating AI into store operations to help employees work more efficiently, but workers have also reported having to correct instructions that don't make sense in the reality of the store. In one example, an AI-powered delivery system directed workers to pick up frozen items too early in a route, creating exactly the kind of practical problem a human who understands the job would recognize immediately.
The AI had information.
The worker had context.
That difference matters.
I've built enough companies to know that some of the most important decisions you'll make don't arrive with a neat spreadsheet telling you exactly what to do. You can have the numbers, the projections, the research, and 14 tabs open on your laptop and still need someone in the room who understands what's actually happening.
A great salesperson knows when pushing harder is about to kill the deal. A great leader recognizes when the person saying "I'm fine" definitely isn't fine. A great operator can look at a plan that works beautifully on paper and tell you where it's going to fall apart once actual human beings get involved.
We're going to automate a hell of a lot over the next few years, and I'm all for it. I just don't think efficiency should become an excuse to remove judgment from the moments where judgment matters most.
What Does Human Oversight Actually Mean?
Human oversight means somebody with enough understanding and authority is still close enough to the decision to question it, stop it, and own what happens next.
I think we're going to hear the phrase "human in the loop" so much over the next few years that it's eventually going to mean almost nothing.
Putting a person's name on an approval screen isn't human oversight if that person has no context, no time to review the decision, or no real ability to change what happens.
The human can't just be there for decoration.
The American Bar Association recently highlighted this problem in the legal profession. AI agents can now manage multistep workflows, communicate, retrieve information, update systems, and make conditional decisions, but many systems still have weak monitoring, limited audit trails, and inadequate controls for stopping an agent once it's operating.
That's not really an AI problem to me. That's a leadership design problem. If you're going to give a system authority, you also have to decide where its authority ends.
What can it approve on its own?
What requires another set of eyes?
What happens when something looks wrong?
Who can stop it?
And when the decision goes sideways, whose name is attached to the outcome?
Those aren't technical questions. They're leadership questions that happen to involve technology.
What Does Accountability Have to Do With Authority?
Accountability becomes a trust signal when people know you'll stand behind the decisions made under your leadership, especially when the outcome isn't the one you wanted.
We've spent a lot of time talking about authority as something people recognize through expertise, proof, reputation, consistency, and the signals you leave behind.
There's another signal that deserves more attention. Do you own your decisions? I've met plenty of leaders who are fantastic at owning the win and suddenly develop amnesia when something goes wrong.
We all know that person.
Real authority looks different. The leaders I've trusted most over the years weren't perfect. They made bad calls. I've made plenty myself, including some spectacularly expensive ones. The thing people remember is what happens next.
Did you explain what happened?
Did you fix what you could?
Did you learn something?
Did you change the system so the same mistake was less likely to happen again?
Did you stand in front of your team and own your part of it?
That's authority too. And I think it becomes even more important when we're delegating pieces of our businesses to technology that can act faster than any human team we've ever managed.
How Does Authority Architecture Change When AI Can Act for You?
Authority Architecture becomes more important when technology can represent you, because every decision made on your behalf becomes another signal about what your leadership actually stands for.
This is where the conversation goes beyond content, profiles, search, or whether AI understands what you're known for.
Your authority is being shaped by the experience people have with everything operating under your name.
That includes the humans on your team. It increasingly includes the AI too. If your agent sends the email, your customer doesn't really care that "the AI wrote it."
If your automated system makes an unfair decision, the person affected isn't going to build a relationship with your model provider to work through it.
They're going to look at your company. Your name. Your leadership. That's why I think Authority Architecture has to include more than being recognizable for a clear idea.
The signals around your authority also need to reinforce how you operate, what you believe, and what people can expect from you when something doesn't go according to plan.
Technology can carry your message farther. It can also carry your mistakes farther. Either way, your reputation is attached to the outcome.
What Does This Mean for Leaders?
Leaders need to get much clearer about what they're willing to automate before they get excited about everything they're able to automate.
I use AI every day. Rachel and I are building YOUmanize™ around it. I'm not interested in slowing this technology down simply because there are risks involved.
Every meaningful technology I've lived through came with risks. I've also been around long enough to know that "the tool let me do it" and "I should've done it" are 2 completely different conversations.
The companies that get this right won't be the ones with the most agents running around behind the scenes.
They'll be the ones that know exactly where those agents create leverage, where a human still needs to make the call, and who owns the outcome when the line between the 2 gets messy.
That feels a lot more important to me than another list of 47 AI tools you need to download before Friday.
Final Thought
For the last few years, most of the AI conversation has been about capability.
What can it write?
What can it build?
What can it automate?
How much faster can it make us?
We're entering the part of the conversation where capability isn't the only thing that matters. AI agents can increasingly do things for us, and that means leaders have to decide what authority we're willing to give them.
I don't think leadership disappears when the work gets automated. I think leadership becomes more visible in the boundaries you set, the judgment you keep, and what you're willing to own when the system gets something wrong.
Maybe that's the human part we shouldn't automate away. The machine can make the call, somebody still has to put their name behind it.