Most conversations about AI agent autonomy are really conversations about capability. Can the model handle the edge cases? Is it accurate enough? Will it hallucinate under pressure? Those are fair questions, and they're the ones most teams spend their time on.

But there's a small set of industries where none of that matters, because the ceiling isn't technical, it's statutory. A licensed professional carries personal legal liability for the output, and no amount of model improvement changes who the law says is accountable. Screening more than 200 companies building AI agents that take real actions surfaced the same five categories again and again, each blocked by a different, specific legal mechanism.

Here's what they are, and just as importantly, why almost nowhere else works the same way.

A physician or therapist's signature is legally required on clinical documentation. This is why every credible ambient scribe product, the tools that listen to a patient visit and draft the clinical note, returns a draft. The AI can transcribe, summarize, and structure the encounter. It cannot sign it. That signature isn't a formality; it's the mechanism that assigns legal and professional responsibility for the record, and that responsibility is not transferable to software.

Health insurers increasingly use AI to help process prior authorization requests, but a clinician still has to be in the approval path. Part of why: the Centers for Medicare & Medicaid Services deferred rulemaking on AI governance in its 2026 Medicare Advantage final rule. Absent explicit regulatory permission to do otherwise, health plans have no incentive to remove the clinician from a decision this consequential, they're not going to get ahead of guidance that hasn't been written yet.

A licensed customs broker has to file the entry, and that broker carries personal liability for its accuracy. An AI agent can prepare the documentation, flag discrepancies, and speed up the process considerably. It cannot be the party that's legally on the hook if the filing is wrong that requires a license, and licenses attach to people, not software.

Fiduciary duty means an analyst or an investment committee has to be the one making the call, not a model. In the same 200-company screen, every single investment research company observed six for six kept a human decision-maker in that seat. That's not caution; it's a legal duty owed directly to the client, and fiduciary duty doesn't have a mechanism for delegating itself to an algorithm.

The Sarbanes-Oxley Act requires segregation of duties and documented approvals at public companies. An AI agent that both prepares and approves a financial entry would collapse a control SOX specifically requires to stay separated. This one isn't really about trusting the AI's accuracy at all, it's a structural requirement that the same party can't both do the work and sign off on it, whoever or whatever that party is.

Look past the industry labels and the underlying mechanism is the same in every case: a named, licensed, or legally accountable human has to be the one who ultimately commits the action, because the law has decided that responsibility needs to sit with a person who can be held to it. A model getting more accurate doesn't change that. GPT-5, GPT-10, whatever comes after none of it moves a statutory requirement.

This matters because it draws a clean line between two very different kinds of "why isn't this fully autonomous yet." In these five categories, the honest answer is "it's not allowed to be, by law." Everywhere else, the honest answer is closer to "it's allowed to be, and increasingly, it already is."

That second category is much bigger, and it's where most of the risk in the AI agent market actually lives. Plenty of industries have no statutory requirement for a human to be in the loop at all ,and companies are moving fast to remove them. A billing platform completing 97,000+ actions in 30 days. An insurer settling 96% of first notices of loss with no human intervention, some in two seconds flat. A support platform resolving up to 93% of queries ,including issuing refunds ,without escalating to a person.

None of that is illegal. None of it requires a license the way filing a customs entry does. It's simply autonomous, by choice, because the company decided the model was good enough and the volume made full automation worth it. And that's exactly where the guardrail gap tends to live ,not in the five regulated industries above, where the law already forces a check, but everywhere else, where the only thing standing between an agent and an irreversible mistake is whatever the company decided to build.

Threshold rules and permission scopes are common in that unregulated territory, but they check amount and access ,not whether this action, on this record, is actually correct. A refund issued to the wrong customer, a claim settled against the wrong policy, a record updated on the wrong account ,all of these can satisfy every rule in a typical guardrail stack while still being wrong, because nothing evaluated the specific action at the moment it committed.

This is the layer Salus operates in ,for the much larger set of industries where autonomy is legally permitted but still needs a check. Salus is a runtime control plane that sits between your agents and your tools: every proposed action is evaluated against policy and evidence before your backend executes it. Actions that don't hold up are blocked, clarified, or escalated with a decision receipt attached, and most actions ship untouched. In controlled testing on AgentDojo's banking environment with GPT-4o-mini, adding this kind of check brought mean prompt-injection attack success down from 47.7% to 0.69% across three repetitions ,without slowing the agent down the way a mandated human reviewer would.

If you're building or buying an agent in one of the five regulated categories above, the law has already made the decision for you: keep the licensed human in the loop, full stop. If you're building anywhere else, the law isn't going to save you from a wrong action ,which means the check has to come from the system itself.

Start with the single action in your product where a mistake would actually hurt ,the one closest to a regulated industry's "why this needs a check" logic, even if no regulator requires it. Replay recent traces to see what the agent has actually been doing, write an explicit policy for that one action, and run it in shadow mode alongside production so you can see exactly what would have been caught before you touch enforcement.

The five industries above got their check for free, written into law decades before AI agents existed. Everywhere else has to build it.