Agentic AI developers are becoming increasingly important as AI agents spread quickly through Australian organisations. The Governance Institute of Australia estimates that just over half of organisations have already deployed them. Keeping agents reliable once live is harder. In a Sinch survey of enterprises using AI agents in customer communications, 63% of Australian respondents had such agents in production, yet 84% had rolled back or shut one down after a governance failure.
Because agents act in business systems rather than only producing answers, the question extends to how much they should be allowed to do. In May 2026, the Australian Signals Directorate’s Australian Cyber Security Centre and its counterparts in the United States, United Kingdom, Canada and New Zealand published joint guidance on agentic AI recommending that autonomy be granted gradually: start with low-risk tasks and widen access only as controls and evaluation mature.
That makes hiring agentic AI developers a longer-term decision than it first appears, because the people who build and supervise agents shape how far those agents can go. This article looks at how that authority grows, when it belongs inside your organisation, and how Build-Operate-Transfer (BOT), a model in which a partner builds and runs a dedicated
Why AI agents change what you need from developers
An agent that drafts a reply or reconciles an invoice is easy to demonstrate. Running it inside a bank or a utility, with live customer data, connected systems and nobody checking every step, is a different engineering problem. Production depends on the paths nobody planned for: an API that times out, an instruction hidden inside a customer email.
An agent relies on a model to reason, decide and act, using tools, data sources, memory and permissions to reach business systems. Each component adds to the attack surface, and an unexpected result in one step can carry through the steps that follow. The work of agentic AI developers therefore extends well beyond the model:
| Layer | What agentic AI developers engineer | Why it matters |
|---|---|---|
| Scoped autonomy | Clear limits on what the agent may decide alone and what needs approval | Prevents an agent acting beyond its mandate |
| Tool and data access | Least-privilege permissions for each system the agent can reach | Limits the damage if an agent behaves unexpectedly |
| Guardrails and human oversight | Input and output controls, escalation paths and review points | Keeps people accountable for consequential actions |
| Observability | Tracing of every step and tool call | Makes failures diagnosable and actions auditable |
| Security | Defences against prompt injection, data leakage and unsafe tool calls | Protects customer data and connected systems |
Production-ready AI agents need these layers in place before they touch live data, with someone accountable for each. And once an agent proves itself, the business will want it to do more.
Autonomy should be earned in stages
The guidance advises never granting agents broad or unrestricted access, especially to sensitive data or critical systems. It recommends what it calls graduated autonomy: increasing an agent’s access and independence step by step while keeping human oversight, with continuous evaluation deciding when to expand its scope or roll it back.
The stages below are an illustrative application, not prescribed by the guidance. Each organisation will set its own thresholds.
| Stage | What the agent may do | What agentic AI developers put in place | Evidence to move up |
|---|---|---|---|
| Recommend | Drafts, summarises or suggests; a person takes every action | Grounding, evaluation against reference tasks, output logging | Output quality holds against reference tasks over time |
| Act with approval | Prepares actions that a person approves before execution | Approval workflows, scoped tool access, step-level tracing | Reviewers rarely need to correct or reject proposed actions |
| Act within set limits | Completes low-risk, reversible tasks without approval | Least-privilege permissions, hard constraints, rollback, anomaly alerts | Issues are detected, contained and reversed within agreed limits |
| Wider scope | Takes on broader tasks or connects to more systems | Stronger identity controls, independent monitoring, red teaming | A documented risk assessment approves the expanded scope |
Even at the widest stage, the guidance says high-impact actions should not run without prior human approval. And each step up the table is still a decision someone has to make.
How Agentic AI Developers Gain Authority Over Business Processes
Every move up that table lets software act with less supervision on the organisation’s behalf. The guidance keeps that decision with people: designers or operators, not the agent, determine when human approval is required, and organisations should define accountability and risk ownership for agentic AI in their policies.
The Governance Institute’s white paper, Governance in the age of agentic AI, developed with Mallesons, SEEK and the University of Melbourne among others, takes the same view. Its first priority is clear accountability, with an owner for every agent deployed, and it notes that organisations and their directors should assume they will be held accountable for agentic outcomes.
The engineers who configure permissions, read the traces, handle incidents and recommend each expansion of scope build up real authority over how agents behave. When the AI agent developers doing that work sit with an external provider, much of that judgement sits there too. That is workable while agents only recommend or act with approval, and harder to justify as they gain autonomy over consequential processes. When comparing AI agent development services, ask:
- Who approves an increase in an agent’s autonomy, and on what evidence?
- How are permissions scoped, reviewed and revoked?
- Who can pause or stop an agent, and how quickly?
- How do your own architects and risk teams take part in these decisions?
The answers show where authority sits today. Where it should sit depends on how far your agents are expected to go.
When the team behind your agents should be yours
Not every organisation needs to own this capability. If agents stay at the early stages, project-based AI agent development services or a dedicated team can be the right fit, as covered in when dedicated AI developers make sense for a growing AI roadmap. The case for ownership grows when agents move towards sensitive data or critical systems, share permissions and controls across several use cases, act within regulated processes, or will keep gaining autonomy for years.
This overlaps with the wider question of where long-term AI capability should live, but agents add one more reason. The joint guidance recommends that organisations build AI literacy, and the Governance Institute lists capability uplift among its priorities. Authority over autonomous systems is hard to exercise without people inside the business who understand how they behave. Once the team should be yours, the question becomes how to build it.
Building a Team of Agentic AI Developers Through a BOT Centre in Vietnam
Organisations that hire AI agent developers locally compete for scarce skills. PwC’s 2026 AI Jobs Barometer found that Australian job advertisements seeking AI skills more than doubled in a year, from 20,000 in 2024 to 41,000 in 2025. Leaving the work with a provider indefinitely keeps the authority outside the business.
The Build-Operate-Transfer (BOT) model offers a path between the two. The partner recruits and runs a nearshore team with an agreed route to client ownership, and its phases mirror graduated autonomy:
- Build. The team forms around the client’s architecture, security requirements and engineering standards, working in client-approved environments while agents operate at the early stages.
- Operate. CBTW runs the centre while the client’s architects, product owners and risk teams take a growing part in decisions on permissions, incidents and scope.
- Transfer. When the client is ready, the agentic AI developers who built and supervised the agents move into client ownership, with their practices and governance.
CBTW has completed more than 25 BOT engagements and transferred more than 1,000 engineers into client-owned operations. Its Vietnam-based teams serving Australian clients process code only in client-approved environments, supported by an ISO 27001-certified delivery environment, documented tooling policies and human review requirements.
Map the autonomy path for your first agent
Before the first agent goes live, map how far its autonomy is expected to grow, which systems it will eventually reach and who should hold authority at each stage. If the answer points to people inside your organisation, plan for that team from the start.
Talk to CBTW about building a team of agentic AI developers in Vietnam, or explore our Build-Operate-Transfer services.
