The contract manager should ask the business owner to replace broad verbs such as manage or automate with the actions the provider is permitted to perform. Reading information, recommending a decision, editing a record, communicating an offer, and executing a transaction are different services. They should not inherit the same authority by implication.
Mayer Brown recommends defining agentic services through delegated authority and operating guardrails rather than software access alone.1 The schedule proposed here connects that contractual description to the actual tools and systems used. It should be usable by the people who configure, supervise, test, and investigate the service.
Begin with a specific workflow and record where the provider acts on the buyer’s behalf. Identify the represented business owner, affected customers or third parties, permitted systems, and intended result. A schedule that only names the AI platform leaves the commercial promise disconnected from the work the buyer receives.
For each material action, state the permitted purpose, scope, conditions, and limits. Identify the decisions retained by the buyer and the point at which the provider must request approval. Include prohibited actions and changes requiring a new mandate. Where different buyer entities have different conditions, identify the applicable schedule rather than leave selection to the agent.
A hypothetical service-desk agent may reset an account under a defined procedure but lack authority to grant a privileged role or waive an identity check. The schedule should say who approves an exception and how that approval is bound to the case. A general instruction to resolve tickets does not answer those questions.
The study describes a joint governance model designed for work performed by people and decisions that could not keep pace with agents.2 A service schedule should therefore describe the actual action boundary and decision route, rather than depend on an assumption that a person will notice an unexpected request before execution.
Figure 1 proposes an authority schedule with contractual and operating fields side by side. For each limit, identify the enforcement point, owner, test, and record retained. The lawyer should not be asked to design the technical control, but the commercial acceptance should require a demonstrable connection between the promise and its implementation.
Ask the provider to show an allowed action, a denied action, and a request requiring buyer approval. Verify the result in the receiving system. Include attempts through alternate tools or delegates where those routes exist. A restriction in a prompt is weaker than evidence that the consequential system rejects the unauthorized act.
The schedule should also state what happens when authority cannot be established. Define whether the task stops, moves to an approved human route, or returns to the buyer. Require visibility of pending work and the reason for restriction. The provider should not manufacture an approval or silently broaden the interpretation of its mandate to satisfy a completion target.
An added tool, changed destination, new customer group, or broader decision role can change authority even when the platform name remains the same. Require the provider to identify material changes before production use and provide the evidence necessary for joint acceptance. Routine maintenance should not become an unrestricted permission to expand the service.
Morgan Lewis’s public outsourcing report highlights the need to revisit governance, data, intellectual property, and pricing throughout the relationship.3 The schedule should have an owner and version history, with a clear rule for which version governs each run. Retain the prior version when it is needed to reconstruct an action.
Revocation should specify who may withdraw authority, how quickly the decision reaches execution, and how active sessions, delegates, queues, and outstanding approvals are handled. The buyer and provider should test that route. Removing a contract entitlement without changing the operating systems leaves an unresolved control gap.
Local counsel should review the authority schedule against applicable EU, UK, Swiss, US, or other obligations. Contractual permission cannot confer authority the buyer does not possess, remove a customer right, or replace a regulated professional decision. Keep the business description common where possible and document the jurisdiction-specific conditions that matter.
The practical objection is that a detailed schedule can become difficult to maintain. Use a concise action taxonomy and link to controlled technical records rather than copying every configuration into the contract. The schedule must still identify material boundaries and a binding change route. Convenience should not make the governing instruction unknowable.
Before signature or expansion, require the business, legal, security, and delivery owners to reconcile the schedule with the tested service. Close unresolved contradictions and record any restrictions. The result should be an authority statement that both firms can execute and investigate, rather than a contract that grants a service name without defining the acts behind it.
The study is a nonrepresentative cross-section of 850 vendor delivery-team respondents on 150 engagements serving Tier 1 financial institutions, collected during January–June 2026. Neither banks nor vendors corroborated the accounts. It establishes reported experience, not causation, legal breach, or market prevalence. Its application here is a mechanism to investigate, not an estimate of conditions in other industries. The author-supplied version 1.8.2 is dated November 1, 2026 and is cited as a forthcoming manuscript consulted October 23, 2026.4
This is an analytical decision paper based on the supplied study and selected primary public sources checked through October 23, 2026. The original contribution is a contract-to-execution authority schedule linking permitted acts, reserved decisions, enforcement evidence, material changes, and revocation. The proposed method has not been independently validated. Legal requirements depend on the entity, activity, jurisdiction, and effective provisions; supervisory observations, research, and professional commentary have distinct authority.