It’s been clear to me over the last year of service provider and enterprise interviews that the current ceiling on AI is not the capabilities of the technology, which grow more advanced every year, it’s the rate of advancement of processes, best practices and skills that surround it.

In automated interactions, the next ceiling won’t be what technology can understand. It may be what organisations are willing to let it decide, and what customers will accept as a legitimate company decision.

Automation, and companies in general are comfortable when the outcomes are predetermined. A customer wants to change an address, the system verifies their identity, and the address is updated. The system is executing a workflow rather than exercising judgement.

Agentic systems are different. They can interpret evidence, apply policy, choose an action and, increasingly, execute it. This is all rosy and happy while the AI is doing tasks that the customer agrees with, but if we only limit the systems to things with a positive customer outcome, then we place a hard ceiling on the types and volume of inquiries it can process. This brings us to a harder challenge, how do we build an AI agent that can say no, and what does the customer do/feel when that happens?

I have started to use the term ‘vested authority’ for this, as I think it captures the spirit of what I mean, that is the decision power an organisation delegates to an AI system and stands fully behind. So more plainly, ‘The AI is allowed to do these sorts of actions, if it takes any of these actions, that is within our policy”.

It is a distinction from legal or moral authority which still rests entirely with the company. No judge will accept ‘well we delegated the decision making on that issue to the AI agent, so it is not our fault’.

The practical distinction is that any decision within the system’s “Vested Authority” will take place without prior or active human approval. Though the company is still liable for the outcomes of that decision.

There is also a challenge being created here that I call the authority acceptance gap: the distance between the authority an organisation has given its AI, and the authority customers recognise it as having.

A denial is the real test

Imagine a customer reports that a device failed shortly after purchase. The images could indicate impact damage or a manufacturing fault. An AI agent collects the evidence, checks the warranty policy and concludes that accidental damage is more likely. It denies the replacement request.

The customer asks to speak to a person. The system says that a review is available only if the customer can provide new evidence, identify a policy error or request a recognised exception. From the company’s perspective, the interaction may be resolved. But the central question is, does that customer view the interaction as resolve (even if unfavourably from their perspective) or do they view this as an automated obstacle may be blocking access to the real decision-maker.

That leaves four questions:

• Was the decision accurate, and how confident is the organisation that relevant evidence was not missed?
• Does the AI’s answer count as the company’s decision, or only as a recommendation that a person should confirm?
• What grounds should reopen the decision, and who has the authority to change it?
• If the customer goes away, did they accept the decision or simply give up?

That final distinction matters. It is tempting to assume that customers with valid cases will push harder, while customers who know they are outside policy will stop. That is not a safe inference. People with legitimate cases may abandon a challenge because of time, language, disability, low digital confidence or the simple belief that resistance is pointless. Persistence is not proof of merit, and silence is not proof of acceptance.

From automation to authority

Most current discussion about AI agents focuses on permissions, guardrails, approval thresholds and human oversight. Those are necessary controls, but they are mainly internal. They tell the company what the system may do. They do not tell us whether a customer will regard the resulting decision as legitimate.

Cavell’s last ‘Voice of the Consumer Report’ which surveyed 2,000 UK consumers found that customers were more willing to use email or online service for routine matters, but massively preferred to phone when an issue was urgent, contentious or already going wrong. In addition, over half of the consumers we surveyed believed that speaking to a human agent was not only the fastest, but also the best way to resolve their queries.

If this remains true, and customers want to phone and reach a real human to resolve their issues the second that there is a complication or element of urgency, it would be easy to treat that as a permanent ceiling on automation. While as an analyst I would adore this, as it would make forecasting wonderfully simple, reality is less cooperative.

However, I think in practice many urgent or complaint-based interactions can be automated, particularly when the system can deliver the outcome the customer wants. Many use cases are emerging of AI agents being deployed to handle surge queues during a crisis e.g. fast-moving forest fires. In those instances, customers are happy to receive immediate clarity on the unfolding situation from automation rather than waiting to get the same from a human agent.

However, where the problems start to arise is not where the customer is receiving a positive outcome as that does not usually test whether the customer accepts the system’s authority, only an adverse outcome will do that.

The operational ceiling therefore depends on more than complaint volume, and complaint type. It depends on the number and severity of adverse decisions, the confidence required to make them, the proportion that qualify for review, the overturn rate and the customer’s response. If every disputed decision needs a human to repeat the work from the beginning, automation shifts work rather than removes it. If no meaningful review exists, the saved cost may return as repeat contacts, complaints, churn or regulatory risk.

A framework for vested authority

To make the concept useful, I’ve defined the following 6 areas that I think represent distinct decision or review points within this process.

These dimensions are not interchangeable. Capability and autonomy are technical and operational. Vested authority is a governance decision. Conveyed and accepted authority concern the relationship between the organisation and the customer. Contestability is a procedural safeguard. The stakes and reversibility of the decision cut across all six: changing an address is not the same as refusing credit, cancelling insurance or closing an account.

Accepted authority is also an outcome to measure, not a property that a company can declare. A policy document may say that an AI has final authority, but that does not make the decision credible to the person affected by it. That credibility is vital to preventing immediate escalation when the outcome the customer seeks differs from the result that the AI is providing.

Regulation creates different authority ceilings

It’s worth noting that in some parts of the world, European regulation does not impose one answer. Since 2 August 2026, Article 50 of the EU Artificial Intelligence Act has generally required people to be informed when they are interacting with an AI system, unless that is already obvious. Its human oversight requirements apply to high-risk systems, while its right to explanation covers certain decisions based on high-risk AI that have legal or similarly significant adverse effects. These provisions do not create a general right to reach a human after every AI-mediated service decision.

The UK takes a similarly use-specific approach. The Data (Use and Access) Act 2025 created a more permissive framework for solely automated decisions with legal or similarly significant effects, while retaining safeguards that include information, challenge and human intervention. It does not give consumers a general right to reject an automated service channel and demand a human agent.

Spain now goes further in the customer service channel itself. Law 10/2025 on Customer Service entered into force on 28 December 2025, with a 12-month adaptation period for essential-service providers and large consumer-facing companies within scope. It prohibits automated answering systems and conversational bots from being the exclusive means of customer service. Customers using telephone or electronic channels must be able to request real-time assistance from a human operator, including from the beginning of an automated interaction. The law also requires 95% of requests for personalised assistance to be answered, on average, within three minutes.

Spain therefore gives customers a legal mechanism for refusing automation as the company’s exclusive representative, even when the AI is capable of handling the issue. It does not necessarily require every human contact to become a fresh, unrestricted decision. It separates access to a person from the grounds for reopening the merits of a decision. For international organisations, the authority ceiling now varies by jurisdiction as well as by decision type, risk and customer vulnerability.

The escalation trap

There are two bad extremes.

No meaningful review

Removing the route to review maximises apparent containment, but it makes the automated decision final even when facts are missing, policy has been misapplied or the model is uncertain. It can trap customers inside the channel, hide systematic errors and disadvantage people who are least able to find another route into the organisation.

Unstructured reassessment

Treating every human handoff as a fresh, discretionary negotiation creates a different problem. The AI’s answer becomes provisional. Customers learn that a refusal is the opening position rather than the company’s decision, and the organisation pays for both the automated assessment and a complete human reassessment.

That is different from guaranteeing access to a human. A human agent can explain the decision, identify a possible error, record a complaint or recognise an exception without automatically discarding the work already done. Human access and decision review should be designed as related but separate processes. In jurisdictions such as Spain, access to a human cannot be gated behind a recognised ground for appeal.

Replace generic escalation with bounded contestability

After an adverse decision, the system should explain the grounds and make review available when a defined condition applies. In practice this lays out the bounds within which the AI’s decision can be appealed, making it clear that the company views the already made decision as final unless there is a substantial reason to change the decision.

These conditions determine when the merits should be reconsidered; they must not be used to obstruct a separate legal or policy right to human assistance. Review conditions might include:

• a material fact is wrong or missing
• the customer can provide new evidence
• the relevant policy appears to have been applied incorrectly
• the system’s confidence is too low for the impact of the decision
• the customer’s circumstances trigger a vulnerability or high-risk review
• the customer is requesting a discretionary exception rather than claiming that the original decision was wrong
• the customer is making a complaint about the process or treatment, which should remain distinct from an appeal on the merits

The human reviewer needs the evidence already gathered, enough independence to test the decision and real authority to change the outcome. If that person can override the AI, ultimate institutional authority still sits with the company and its human governance. The AI holds vested authority to make the initial decision; it does not become an independent final authority.

Under this model, the AI’s decision remains final unless there is a meaningful reason to overrule it. Over the long term this creates an expectation where customers may only escalate to a human where they have a genuine belief that there is another element to their request that is not being properly considered.

It puts the human agent in the position of strength where they can explain or confirm the AI’s decision, identify if there are any grounds for review, or explain why a change in the decision will not be possible at this stage.

Though within this context it’s also important that this ‘bounded contestability’ must not become a procedural wall designed to suppress valid appeals. The grounds need to be plain, accessible through more than one channel and monitored for unequal use or outcomes.

Convey authority without impersonating it

An AI making an adverse decision should:

• disclose that it is an AI system
• state that it is acting on behalf of the company and describe the scope of its authority
• explain the material facts and the relevant policy in clear language
• distinguish ‘the system cannot do this’ from ‘the company’s policy does not permit this’
• say what evidence or review ground could change the outcome
• provide a usable review route and an expected response time
• explain any right to human assistance and whether a handoff will reopen the decision or provide support within the existing decision
• avoid saying that a human would make the same decision unless the organisation has tested and enforces that consistency
• avoid claiming absolute finality when people retain undisclosed discretion to make exceptions

The objective is both to make the AI sound empowered with decision making capabilities, and to make the organisation’s decision structure legible. Customers should understand that a decision has been made, that it is the decision the company feels is correct, and what could potentially change it.

Measure acceptance rather than containment

Containment alone can misread silence as success. Vested authority needs a combination of operational, quality and legitimacy measures.

A low review rate is not, by itself, evidence that customers accept the AI’s authority. It may mean the decision was clear and credible, but it may also mean the review process was too difficult or appeared pointless. Behavioural data needs to be read alongside customer feedback, independent audits and the outcomes of those who did contest the decision.

The authority ceiling

Organisations should not ask only what an AI can do. They should ask which decisions they are willing to own when an AI makes them, which adverse decisions need review, and how the customer will know the difference.

If authority is delegated but hidden or poorly defended, the acceptance gap widens. Escalations become more combative, customers route around the automated system, and apparent efficiency disappears elsewhere in the journey. If the scope of authority is clear and the organisation provides credible, bounded contestability, AI can handle more than routine requests that end in yes.

Agentic customer experience may therefore reach an authority ceiling before it reaches a capability ceiling. A better model alone will not remove that ceiling. It must be addressed through governance, communication and review design.

Hope you enjoyed this explanation of one of the many challenges in best practice that I see being obstacles to broader AI adoption in the contact centre. This is part of a broader research process which is evaluating the progress of adoption of AI in Customer Experience, with the majority of the evidence pointing towards a slow and controlled rollout, rather than an industry in the process of imploding.

If you’re interested in this topic or are wondering what Cavell’s broader research says about the development of the CX space, please get in touch.