Reliable GTM agents run on an operating loop with four verbs: Propose, Approve, Commit, Roll back. Every action an agent can take gets a blast-radius tier, every approval shows the evidence, autonomy is earned per agent per action class, and every commit can be undone. This playbook, Volume 1 of three, gives the loop as twelve practices, with the human in the loop designed as a working control rather than a checkbox.

The urgency is documented. Gartner forecast in June 2025 that over 40 percent of agentic AI projects will be canceled by the end of 2027, naming cost, unclear value, and risk controls as the causes. A July 2026 Forbes analysis by Robert Szczerba located the failure in management practice, a "capability-deployment verification gap": agents that work in the demo and fail on live proprietary data. The same piece cites Forrester: 75 percent of enterprises have adopted agentic AI, and few have reached production. The cancellations are an operations gap wearing an AI costume.

LangChain's June 2026 State of Agent Engineering survey of 1,340 practitioners fills in the mechanism. 89 percent of teams run observability on their agents while only 52.4 percent run offline evals, and quality is the top blocker respondents name. Teams watch their agents. Far fewer test them before granting more rope.

Figure

The production gap agent programs are stuck in

40%+of agentic AI projects forecast to be canceled by end of 2027Gartner, 2025

75%of enterprises adopted agentic AI, while few reached productionForrester via Forbes, 2026

89%of agent teams run observability on their agentsLangChain, 2026

52.4%of agent teams run offline evalsLangChain, 2026

Sources: Gartner, Jun 2025 · Forbes citing Forrester, Jul 2026 · LangChain State of Agent Engineering, Jun 2026

This playbook is Volume 1 of three. It covers making a single agent behave: blast-radius tiers, approval design, the trust gradient, rollback, and escalation. Volume 2 covers agent orchestration: shared context across the fleet, coordination between agents, and why 100 agents without a shared brain replay the old handoff failures at machine speed. Volume 3 covers evaluating agents in production. The three are one discipline. This volume is where every team starts.

The reference pattern: Propose, Approve, Commit, Roll back

Every practice below hangs on one loop. In the GTM Harness, RevSure's live product surface, a consequential agent action moves through four states. The agent proposes the action with the evidence behind it. A human approves it, or a policy the agent has earned approves it automatically. The system commits it and records a Decision Trace, an auditable record of what was done and why. And any commit can be rolled back. Three agents run this loop in production today: the Campaign Reallocation agent, the Deal Risk agent, and the Deanonymization agent. Treat the pattern the way engineering teams treat a version control workflow: a reference to adapt, with the verbs kept intact.

Each verb makes a demand on the system. A proposal must carry its evidence, or approval becomes theater. An approval must carry the identity and reasoning of whoever granted it, or accountability dissolves. A commit must leave a trace, or the audit trail is a reconstruction. And a rollback must restore known state, or reversibility is a claim on a slide. The twelve practices below are those four demands, made operational.

The appetite for agents is already on record. In RevSure's January 2026 study of 306 senior US and UK GTM leaders, The 2026 State of Agentic AI in B2B GTM, 76 percent were deploying or implementing agentic AI and 41 percent had implemented. Another 96 percent believed agents with full-funnel context would significantly improve execution, and 90 percent called agentic AI critical to their GTM goals within two years. The distance between the belief numbers and the implementation number is where reliability work lives.

Figure

Commitment runs ahead of implementation

306 senior US and UK GTM leaders on agentic AI, January 2026

Source: RevSure, The 2026 State of Agentic AI in B2B GTM

Twelve practices follow. Each is short on purpose. The loop is learned by running it, and every practice here is one a RevOps team can start this quarter.

Tier every action by blast radius

Blast radius is what an action can break and how hard the break is to reverse. Tiering is the first act of fleet governance because it converts a vague anxiety about trusting agents into a precise question about which action classes each agent has earned.

1. Classify every action class before any agent runs

Build the inventory first: every read, write, send, and spend your agents could execute, sorted into three tiers.

Tier	Definition	Typical actions	Default control
Read-only	No write, nothing external	Account research, risk analysis, scoring in staging	Autonomous from day one, with logs
Reversible writes	State changes undoable in one step	CRM field updates with prior values kept, staged drafts, internal flags	Autonomy earned per action class
Irreversible spend and sends	Money moves or a buyer sees it	Budget reallocations, live audience pushes, outbound sends	Human approval, with the longest graduation path

Less effective: tiering by system touched, where the CRM counts as sensitive and the ad platform counts as marketing's business. A CRM note is trivial. A live audience push is spend.

Recommended: tiering by reversal cost. A note that can be deleted sits in tier one no matter where it lives. An audience change that starts spending the moment it lands sits in tier three no matter how routine it feels.

2. Grant permissions per agent, per action class

A single trust setting per agent is too blunt to govern anything. The unit of permission is the pair: this agent, this action class.

Less effective: a fleet-wide autonomy toggle, or per-agent flags of the form "the Deal Risk agent is in autonomous mode."

Recommended: a permission matrix. A Deal Risk agent configured this way runs tier-one pipeline analysis autonomously, commits tier-two risk flags with logging, queues anything that would change what a rep does next, and holds no spend permissions at all. A Campaign Reallocation agent gets the mirror image: free to research and to model scenarios, free to stage a reallocation plan, and required to queue every commit that moves money, because every commit it makes is tier three by definition. Same fleet, same loop, different matrices.

3. Start every new agent in propose-only mode

The Forbes verification gap is specific: demos verify capability, never deployment. A demo proves the agent can do the work. Only live history proves it does the work on your data, your definitions, your seasonality, and your edge cases.

Less effective: granting go-live autonomy because the demo was clean and the vendor was confident.

Recommended: a burn-in period on live data in read-only or propose-only mode, with the approval record kept as the graduation evidence. The agent works its full workload; the commits wait for a human. Size the burn-in to the motion, never to the calendar: a campaign agent needs at least one full campaign cycle, a pipeline agent at least one forecast cadence, because an agent that has never seen quarter-end has never seen the data it will misread.

Figure

Blast-radius tiers in practice

Example action classes from a GTM agent configuration

Reversible by design: agent acts, system logs

Account research briefRead-only

Lead score to a staged fieldUndo in one step

Risk flag on an opportunityUndo in one step

Email drafted and heldNever leaves staging

Irreversible in practice: a human approves the commit

Budget reallocationMoney moves

Send to a buyerCannot be unsent

Live audience pushSpend follows instantly

Score published to fields reps useReps act on it

Source: RevSure GTM Harness tiering pattern; action classes shown are illustrative configurations

Approval design that keeps the human in the loop honest

Approval queues fail quietly. The volume grows, the cards say nothing, and within a quarter the reviewer is approving on reflex. That end state is worse than honest autonomy, because it launders agent actions through a human signature nobody stands behind. Harvard Business Review published the organizational version of this finding in May 2026: research from BCG and Boston University found that treating AI agents like employees "reduced individual accountability, increased unnecessary escalation, lowered review quality" without improving adoption. Adding human process without adding judgment made things worse. The queue exists so judgment can happen.

4. Make the approval card carry the whole case

A reviewer can only add judgment to what the card shows. The card must carry the proposed action in plain language, the evidence chain behind it (in RevSure's surface, the Decision Trace), the expected effect and the metric it should move, the reversal path if the commit disappoints, and the decision deadline with what happens on expiry.

Less effective: "Reallocate budget from campaign A to campaign B. Confidence: high." Two buttons.

Recommended: the same proposal carrying which funnel signals triggered it, what the agent expects to change, what rollback restores, and when the window closes. A reviewer who can see the case can disagree with it. That is the point of the queue.

5. Meter the queue like a production system

Instrument the review itself: approval rate, edit rate, time per decision, and expiry rate. An approval rate near 100 percent at a few seconds per decision means review has decayed into ritual. Two honest responses exist. Promote that action class toward autonomy, because the record supports it. Or enrich the card, because the record was unreadable. Keeping a dead review alive is the worst available option: it manufactures accountability theater and trains reviewers to click through the one card that deserved an hour.

Capacity is part of the same instrument. A queue only works when its volume fits inside the reviewer's real attention, so when proposals outrun capacity, raise the agent's proposal threshold instead of letting the reviewer skim. Fewer, better proposals reviewed properly beat a full queue reviewed on reflex, and the tiering from practice 1 tells you exactly which classes to pull out of the queue first.

6. Route the approval to whoever owns the consequence

Budget moves go to the budget owner. Stage-affecting actions go to the manager who answers for the forecast. A central AI team can judge whether the model reasoned well; it cannot judge whether the move fits the strategy. One published story from RevSure's founder makes the case: a CMO was shown a reallocation of $2M away from LinkedIn carrying a 4x ROI case, and declined it, because "LinkedIn is strategic." Retold as an adoption failure, that story is about stubbornness. Read as approval design, it is the system working: the budget owner applied context the model never had. The follow-through matters as much as the veto. Capture the rejection reason as configuration, a pinned constraint the agent honors, so the same proposal stops resurfacing. An approval queue that learns nothing from its rejections is a nag.

The trust gradient: autonomy earned per agent, per action class

Operators already describe agent trust the way they describe human trust: accumulated slowly, and revocable fast.

you go on a first date, it sounds great, but it's only after you've known someone a while that you start to have some confidence.

a marketing analytics advisor

The trust gradient operationalizes that instinct. Autonomy attaches to the pair of agent and action class, arrives after the live history says it is deserved, and can be taken back the day it stops being deserved.

7. Write graduation criteria before the pilot starts

Graduation from approval mode to earned autonomy should be a decision made once, calmly, against criteria published in advance, instead of relitigated in every pilot review. Four criteria cover most action classes: a sustained run of proposals approved without modification across a full cycle of the motion the agent touches (a campaign cycle, a forecast cadence); an edit rate near zero; guard metrics holding through the window; and a human review of sampled decision traces finding reasoning a manager would sign.

In practice the gradient climbs one class at a time. A Campaign Reallocation agent might earn autonomy on research briefs in its first weeks, on staged reallocation plans a cycle later, and on small in-platform budget shifts only after quarters of approved proposals, while cross-channel moves stay behind approval indefinitely. Nothing about that sequence is timid. It is how the team gets to autonomy at all, because each graduated class is a decision nobody has to revisit under pressure.

8. Put a quality cohort behind every volume metric

An agent can hit any volume target you set. The graduation question is what happens to quality while it does.

you might get 100 meetings but none of those meetings are converting... you reduce the cost but that agent is still generating the same quality meetings, the conversion of the meetings is not going to improve just because you deployed an agent.

from a working session with a customer team

Graduation reads the guard metric, never the volume metric alone. An agent whose meetings grow while the meeting-to-opportunity cohort degrades has failed its evaluation, whatever its dashboard says.

9. Demote without ceremony

The gradient runs both directions. A rollback event, a breached guard metric, or a model change underneath the agent returns the affected action class to propose-only mode, and re-promotion re-runs the same graduation criteria. Model changes deserve emphasis because they are routine in agentic stacks: RevSure customers choose the LLM each agent runs on, and an upgrade that improves the average answer can still regress the edge cases an action class depends on. Autonomy earned on one model is evidence about that model, so a swap resets the class to propose-only until the record rebuilds. The discipline is rarer than it sounds: in LangChain's survey, 89 percent of teams watch their agents and only 52.4 percent run the offline evals that would catch a regression before production does. Make demotion cheap and unemotional so people actually use it. A demotion that requires a meeting is a demotion that happens a quarter late.

Rollback is the precondition for adoption

The fourth verb decides whether anyone uses the first three. Leaders adopt agents when the worst case is an undo, and they refuse when it is an apology. The field evidence is blunt. At one company, a propensity model scored 99 percent of 20,000 leads under 5 percent likelihood, and the marketing operations leader who owned the rollout refused to write the scores into the CRM.

I couldn't trust those numbers... it's going to really make everybody feel, should we trust this or not?

a marketing operations leader at a cybersecurity company

The refusal was correct. Fields can be overwritten, so the write looked reversible on paper. The trust cost was not reversible, and the leader priced that correctly: once bad scores reach the fields reps work from, the mistrust outlives the fix. Blast radius includes what people saw.

10. Stage writes and keep the prior state

Less effective: the agent writes scores, enrichments, and stage suggestions straight onto live fields the moment it computes them.

Recommended: writes land in staged or shadow fields first and are promoted on approval or on earned autonomy. Every promoted write keeps the prior value, so restore is one step. Outbound drafts hold in the sequencer until the send is approved. This is the configuration that would have saved that propensity rollout: reps never see the staged column, so a bad model costs a review instead of a quarter of credibility.

11. Rehearse the rollback before you rely on it

An untested rollback is a slide in a deck. Run the drill on purpose: commit a reversible change, roll it back, verify the restored state, and time the whole sequence. The drill also teaches the org what cannot roll back, an email a buyer already opened, budget a platform already spent, which is the working definition of tier three. Teams that have rehearsed the undo approve faster and escalate less, because the worst case has a known shape.

Escalation with the full case file

12. Hand the human a case, never an alarm

Agents stop for good reasons: confidence below threshold, a breached guard metric, conflicting instructions, an expired approval window. What matters is what the stop hands over. The escalation should carry what the agent saw, what it tried, why it stopped, and the options it weighed with their trade-offs, so the human starts warm. Anthropic's context engineering guidance from September 2025 frames agent attention as a finite budget served by the smallest set of high-signal tokens. A human reviewer's attention at quarter close is a smaller budget still, and it deserves the same engineering.

Less effective: "Agent paused. Review required." Twenty minutes of tab archaeology follow.

Recommended: the case file above, a recommended next action, and a deadline, delivered in the channel the team already works in. In the GTM Harness, the escalation arrives with the Decision Trace attached, which is what starting warm means in practice.

Route escalations the way practice 6 routes approvals: to the owner of the consequence, with an explicit deadline and a fail-safe default. An escalation nobody answers should resolve to the safest available state, usually the agent holding position and logging the miss, never to the agent guessing. And meter escalations the way practice 5 meters the queue. A rising escalation rate is an early signal that the agent's goals, guard metrics, or context are misconfigured, and it is a cheaper signal than the failure it precedes.

Governance an auditor can read

ISO/IEC 42001:2023 is the first international standard for AI management systems, and RevSure holds the certification. Stated precisely, because overclaiming a certification is its own trust failure: ISO/IEC 42001 attests that an organization runs an audited management system for how it develops and operates AI, with risk assessment, controls, documentation, and review cadence. It does not certify that any particular agent decision was correct. What makes such a management system real in daily operation is the artifact trail this playbook produces: tier definitions, approval records, decision traces, and rollback logs. When a security reviewer asks how agents are controlled, the answer is a folder, and the loop fills the folder: which agent may take which action class, who approved each commit that mattered, what evidence each decision cited, and what got rolled back when. Teams that run the loop stop dreading the security questionnaire because the questionnaire describes their Tuesday. The same artifacts are the foundation Volume 2 builds on, because agent orchestration is only safe when each agent in the fleet is individually governed.

One concession belongs in this chapter. The loop is process, and process can be overbuilt. An operations leader at a contract lifecycle management company described the failure honestly: "we got too focused on configuring the system correctly, but we are not really able to use the system in our day-to-day right now." Governance that outruns usage is its own reliability failure. Tier fast and start the burn-in, then let the queue metrics tell you where the process deserves more weight.

What to do next quarter

Inventory the verbs. List every action class your agents, and your agent-shaped automations, can execute, and tier each by reversal cost. This fits on one page.
Audit the queue. Pull approval rate, edit rate, and time per decision for the last 90 days. Anything near 100 percent in seconds is a decayed control: promote the class or enrich the card.
Rebuild one approval card. Pick the highest-spend action class and make its card carry the evidence, the expected effect, the reversal path, and the deadline.
Write graduation criteria for one agent and one action class, and publish them before the next pilot review.
Run a rollback drill. Commit a reversible change, roll it back, verify the state, and record how long it took.
Put a quality cohort behind the loudest volume metric an agent can move, and wire a breach to automatic demotion.

Where this comes from

The reference pattern is the loop RevSure operates in production in the GTM Harness, where the Campaign Reallocation, Deal Risk, and Deanonymization agents run today. The field evidence is built from our work inside enterprise GTM teams: indexed, verbatim working sessions with marketing, RevOps, and revenue leaders, quoted here at descriptor level with permission discipline. Two limits are worth naming. This volume covers single-agent reliability; fleet coordination and production evals are Volumes 2 and 3. And the evidence base skews toward B2B software enterprises already motivated to govern their agents, which likely understates how much tiering discipline the median deployment needs.

Frequently asked questions

What is human in the loop for AI agents?

Human in the loop is a control pattern where an AI agent proposes actions and a person reviews them before they take effect. In GTM systems it governs actions with real consequences: budget moves, outbound sends, CRM writes, and audience changes. Mature implementations scope the review to high-stakes action classes so human attention concentrates where reversal is hardest.

What is the Propose, Approve, Commit, Roll back loop?

Propose, Approve, Commit, Roll back is the operating loop RevSure runs in the GTM Harness. An agent proposes an action with its evidence, a human or an earned policy approves it, the system commits it and records a Decision Trace, and any commit can be rolled back. The loop turns agent reliability into an auditable process.

What are blast-radius tiers for AI agents?

Blast-radius tiers classify agent actions by how hard they are to reverse. Read-only actions carry no write risk, reversible writes can be undone in one step, and irreversible actions move money or reach buyers. The tier sets the control per action class: autonomy for the low tiers, mandatory human approval for the highest, whichever agent is acting.

How do AI agents earn more autonomy?

Agents earn autonomy through a trust gradient: permission expands per agent, per action class, as live history accumulates. Graduation criteria are written before the pilot: a sustained run of approved and unmodified proposals, an edit rate near zero, guard metrics holding, and a passed review of sampled decision traces. Demotion works the same way in reverse.

The production gap agent programs are stuck in

The reference pattern: Propose, Approve, Commit, Roll back

Commitment runs ahead of implementation

Tier every action by blast radius

1. Classify every action class before any agent runs

2. Grant permissions per agent, per action class

3. Start every new agent in propose-only mode

Blast-radius tiers in practice

Reversible by design: agent acts, system logs

Irreversible in practice: a human approves the commit

Approval design that keeps the human in the loop honest

4. Make the approval card carry the whole case

5. Meter the queue like a production system

6. Route the approval to whoever owns the consequence

The trust gradient: autonomy earned per agent, per action class

7. Write graduation criteria before the pilot starts

8. Put a quality cohort behind every volume metric

9. Demote without ceremony

Rollback is the precondition for adoption

10. Stage writes and keep the prior state

11. Rehearse the rollback before you rely on it

Escalation with the full case file

12. Hand the human a case, never an alarm

Governance an auditor can read

What to do next quarter

Where this comes from

Related reading

Frequently asked questions

What is human in the loop for AI agents?

What is the Propose, Approve, Commit, Roll back loop?

What are blast-radius tiers for AI agents?

How do AI agents earn more autonomy?

The loop: a reliability playbook for GTM agents