How Agents Earn Authority

Ten points. That's how far trust falls when AI stops answering and starts acting. In IDC research for SAS's 2026 Data and AI Impact Report, 76% of decision-makers said they trust generative AI. Only 66% said the same of agentic AI.

So what would it take to close that gap? IDC's answer is blunt. Stop granting autonomy and make AI earn it.

In a new framework, an IDC research director specializing in governance, risk and compliance sets out six conditions that must all hold before an AI system is allowed to act on its own. It needs sustained accuracy above the threshold for that activity and enough real transaction volume to rule out luck. It needs zero critical human overrides during the measurement window and a complete audit trail. Its outputs have to explain their reasoning and confidence. And its scope has to be limited to exactly what it has already shown it can do.

Note what doesn't count: vendor benchmarks, demos and aggregate customer data. Trust, IDC says, is built in your environment, on your data, with your specific consequences attached.

Here is the part most people miss. The strongest signal isn't an accuracy score. It's the override trend, meaning how often your people correct the AI and whether that number keeps falling across a meaningful sample. One good snapshot proves little. A falling override rate is a record.

That makes autonomy an evidence problem, not a capability problem. In The Right To Act, I argued that delegation does not transfer accountability. IDC's framework shows what owning that accountability looks like. The organization decides what proof it needs before handing over a decision, and keeps the right to take it back.

In tomorrow's guest essay, Walled City contributor Lisa Wolfe explains why AI coding agents need adequate context in order to exercise authority safely. IDC's point is that the same test applies everywhere, from invoice approvals to HR screening.

The IDC research director closes with three questions any company can ask about the AI it already runs. What's the override rate? Is it declining? Has anyone looked at the audit trail in the last 90 days?

If nobody can answer, the agent hasn't earned its autonomy. It has simply been given it.