Delegation: Designing the Agentic Org Chart

Answering and acting are different disciplines, and the difference is not a matter of degree. An answer is evaluated before it’s used — the human reads it, judges it, and decides what to do with it. An action is evaluated after it’s taken. That single inversion breaks most of the design instincts teams carry over from chat: streaming a wrong sentence is harmless because the reader is the safety mechanism; streaming a wrong action is a live incident because nobody stood between the model and the world.

You can see the discipline shift in the products that made the jump. ChatGPT the chatbot needed a text box and a stop button. Deep research, Codex, and agent mode needed plans you can review, activity you can watch, checkpoints where the system pauses for permission. Claude Code is a study in the same evolution — its core surfaces aren’t conversational at all: a permission prompt before commands run, a diff before edits land, a transcript of everything it did. The conversation is the thinnest layer of the product.

The mistake to avoid is treating agentic UX as chat UX with more capable output. The unit of design is no longer the message — it’s the delegation: what work was handed over, under what constraints, with what checkpoints, and with what recourse when it goes wrong. Everything in this chapter is about designing that handoff.

The most durable mental model for an agent is a talented, fast, occasionally overconfident junior colleague. You don’t supervise a junior by hovering over every keystroke, and you don’t hand them production access on day one. You scope: “refactor this module, don’t touch the API contract, ask me before adding dependencies.” The scoping happens before the work starts, which is exactly when people have the judgment to do it well — calm, specific, thinking about the task rather than reacting to a surprise.

Good agent products make that scoping a first-class interface. Claude Code’s permission system is the clearest shipped example: it asks before running commands or editing files, and lets you widen its authority deliberately — allow this command, allow it for the session, allow this tool always. Autonomy is granted in increments, per capability, and the grant is legible. Cursor gates terminal execution the same way. The pattern generalizes far beyond code: an email agent might draft freely, send to internal recipients with a summary, and require explicit approval for anything external.

The alternative — a single global autonomy slider, or worse, autonomy inferred from vibes — fails in both directions. Too tight and the agent nags you into approving everything, which teaches reflexive clicking. Too loose and the first out-of-scope action destroys the trust that took weeks to build. Scoped autonomy is how the relationship compounds: every completed task inside the scope is an argument for widening it, and the human decides when that argument has been made.

Approval gates are where agentic products most often lie to themselves. The team ships a confirmation dialog, checks the “human in the loop” box, and never measures whether the human is actually reviewing anything. They usually aren’t. A prompt that says “Run 3 commands?” without showing the commands isn’t a safety mechanism — it’s a liability-transfer mechanism. It launders the agent’s decision through a human signature, and the human learns to click yes at exactly the rate the agent is usually right, which means the gate fails precisely on the runs where it mattered.

The reflexive yes is a design failure, not a user failure, and the fix is to make the approval reviewable in less time than it takes to get nervous. Show the actual diff, not “edit 2 files.” Show the recipient list and the first line, not “send email.” Claude Code shows you the exact command before it runs; Gmail’s AI drafts sit in the composer, fully inspectable, with the send button untouched. In each case the approval surface contains everything needed to make the call, at the altitude the call is made.

Altitude is the other half. Gating every trivial action produces approval fatigue that defeats the gate; gating nothing produces incidents. Match the friction to the stakes: reversible-and-cheap actions proceed with a visible log, expensive-or-irreversible ones stop and present the case. If reviewing a proposal routinely takes longer than doing the task by hand, the gate is at the wrong altitude — move it up to the plan, not the keystrokes.

Delegation to a person is never fire-and-forget — you can walk over and say “stop, wrong direction” at any point, and the work continues with the correction absorbed. Most agent interfaces still only offer the binary: let it finish or kill it. That’s a vending machine, not a colleague. Cancellation throws away every minute of correct work to prevent one minute of wrong work, so people hesitate to use it, so wrong runs go longer than they should.

The shipped state of the art is better than the average product suggests. ChatGPT and Claude made stopping generation a single click years ago — table stakes. Claude Code goes further: interrupt a running agent, tell it what to change, and it continues with the new instruction folded in, context intact. Every permission prompt is also a steering wheel — deny with a reason and the agent replans rather than dying. Cursor lets you stop a run, edit what you didn’t like, and continue from there rather than from zero.

Two design requirements make steering real. First, the human has to be able to see the drift early enough to act — which is why steering depends on a live working transcript, not a spinner (chapter 4’s legibility argument, now load-bearing). Second, a correction must cost less than a restart, or people won’t bother steering and your interrupt affordance is decoration. Measure it: if your users’ main recovery move is killing the run and re-prompting, you’ve shipped a cancel button and called it steering.

Here is the deal every user implicitly offers an agent: you may act on my behalf, if I can undo what you did. Reversibility isn’t a nice-to-have layered on top of autonomy — it’s the price of autonomy. People delegate freely to systems whose mistakes are cheap to unwind and grudgingly to systems whose mistakes are permanent, regardless of the actual error rate. A 2% error rate is fine when errors cost an undo; it’s disqualifying when errors cost an afternoon.

Software agents inherited a gift here: version control. Claude Code and Cursor operate on git repositories, where every change is a diff and every diff can be reverted — which is precisely why coding became the first domain where people tolerated real agent autonomy. The lesson is transferable: agents win first in domains with an undo, and if your domain doesn’t have one, building it is the actual work. Drafts instead of sends. Staging instead of production. Soft-delete with a recovery window instead of hard delete. Checkpoints an agent run can be rolled back to, not just a log of what it did.

The design consequence cuts deep into scoping: an agent’s autonomy should be bounded by the blast radius of its irreversible actions. Everything reversible can be fast and unceremonious; everything irreversible routes through the approval gates above. When you find yourself designing an elaborate confirmation flow for a destructive action, ask the prior question first — why is this action destructive at all?

When an agent hits the edge of its competence or its authority, it has two options: escalate up to a human, or move sideways into improvisation. Sideways is where the worst agent failures live — the support bot that invents a refund policy, the assistant that guesses at a figure rather than admitting it couldn’t find one, the agent that hits an error and quietly works around the constraint that existed for a reason. Confabulated action is strictly worse than confabulated text, because it doesn’t wait for a reader to catch it.

Escalation is a designed behavior, not a failure state, and the products that do it well treat the handoff as a deliverable. A good escalation carries the full context up the chain: what was asked, what the agent tried, where it got stuck, and what it recommends — so the human starts from the middle of the problem, not from zero. Claude Code stopping to say it’s hit a permission boundary and asking how to proceed is escalation. A support agent transferring to a human with the conversation history and a one-line summary attached is escalation. “Something went wrong, please contact support” is abdication wearing escalation’s clothes.

The bar to hold in design reviews: an agent should be incapable of exceeding its granted authority silently. Every path that crosses the scope boundary must surface — as a question, a pause, or a handoff. If your agent’s response to “I can’t do this within my constraints” is anything other than coming back to the human, you haven’t built delegation; you’ve built a liability with an API key.

The trajectory is unambiguous: agents are running longer, in the background, and increasingly in parallel. Claude Code dispatches subagents; ChatGPT’s deep research runs for many minutes while you do something else; background coding agents open pull requests while nobody watches. Real-time supervision — the human eyeballing a live transcript — stops scaling right around the second concurrent agent. The design problem shifts from watching work to auditing work, and those are different interfaces.

The emerging answer is a split: a stage and a conversation. The conversation is where you delegate, steer, and receive results; the stage is where the work itself is legible — the plan, the diffs, the transcript, the artifacts — inspectable on demand rather than narrated in your face. Claude Code’s transcript view, Cursor’s agent panel, the pull request itself as a review surface for background coding agents: all versions of the same move. The manager checks the work product, not the keystrokes.

What makes asynchronous supervision trustworthy is that the record is complete and honest. A background agent must come back with its receipts — everything it did, everything it decided, everything it skipped — because the transcript is now the only witness. And checkpoints replace interruption: where a foreground agent can be steered mid-flight, a background agent needs designed moments where it parks, reports, and waits before crossing anything consequential. You’re no longer designing a conversation. You’re designing a working relationship with someone you mostly don’t see — which is, not coincidentally, just management.