What Your Terms of Service Should Actually Say About Decisions Your AI Agent Makes Without Human Review

Quick answer

Your terms of service should name, in a dedicated clause rather than buried in a general AI-use disclaimer, the specific categories of decisions your agent is authorized to make without human review (for example: standard refunds under a stated dollar threshold, appointment scheduling, account status changes that are reversible) and separately name the categories that always require human sign-off. Vague language like "our AI may assist with your request" does not meet this bar, because it tells the customer nothing about where the human safety net actually is. Treat this as a contract term with legal review, not a UX copywriting task, since it is the clause a regulator or plaintiff's attorney will read first if an unsupervised decision causes harm.

Why this belongs in the contract, not just the product

Plenty of companies handle AI transparency as a UX problem: a disclosure banner, an "AI-assisted" badge, a chat header. Those are good practice but do not answer the question a contract has to answer, which is what the company is actually authorized and obligated to do through the agent. A UX disclosure tells the customer they are talking to AI. A contract term tells them, and every future court or regulator, exactly which decisions that AI is allowed to finalize on its own. These are related but separate documents, and the second one is frequently missing even at companies that have done the first one well, including companies that have already addressed do you have to tell customers they're talking to an AI agent.

Name categories, not a blanket authorization

A clause that says the agent "may take autonomous actions on your account" is not specific enough to be enforceable in the company's favor if a dispute arises, and it is not informative enough to be fair to the customer either. Name actual categories: automatic approval of returns under a dollar threshold, rebooking a cancelled appointment to the next available slot, applying a previously agreed discount code, versus categories that are explicitly excluded from autonomous authority such as account closure, disputes over an existing autonomous decision, or any action with an irreversible financial consequence above a stated amount. This same category-based thinking is what makes the internal governance version of this problem, giving an AI agent authority to bind the company in contracts, tractable; the terms-of-service clause is simply the external-facing mirror of that internal boundary, written for the customer instead of for engineering and legal.

State the review and appeal path in the same clause

A decision-authority clause that names what the agent can decide without saying what happens if the customer disagrees is only half the disclosure. Pair the authority list with a plain statement of how a customer can request human review of a specific autonomous decision, and how long that review takes. This connects directly to the process described in building an appeal process for an AI agent's autonomous decisions; the terms of service is where you promise that process exists, and the internal appeal workflow is where you actually deliver on it.

Keep the clause current as autonomy expands

The biggest failure mode for this clause is not writing it wrong the first time, it is letting it go stale as the agent is granted new autonomous capabilities over successive product releases without anyone updating the contract to match. Treat any expansion of autonomous decision categories as a required trigger for a terms-of-service review, the same way you would treat a pricing change, rather than something legal only revisits annually. An agent quietly gaining the ability to approve larger refund amounts than the current terms of service describes is a contract accuracy problem, independent of whether the larger refunds themselves are a good product decision.

Distinguish this from boundaries on price or terms negotiation

If your agent is also authorized to negotiate price or terms with a customer, that authority needs its own explicit mention in this clause, separate from operational decisions like scheduling or refunds, since negotiated terms create binding obligations of a different character. The same logic that keeps human-in-the-loop review from becoming a bottleneck applies here: define the boundary precisely enough that most negotiations never need a human, and route the rest automatically.

FAQ

Does this clause need to be in the main terms of service, or can it be a separate policy? Either works legally as long as the main terms of service clearly reference and link to it. What matters is that it is easy to find and specific, not which document it technically lives in.

How often should legal review this clause? At minimum whenever the agent's autonomous capabilities change, and independently on the same annual cycle as the rest of your terms of service.

Is a general AI disclaimer enough if we also have this clause? The general disclaimer and this clause serve different purposes and both are worth keeping: the disclaimer sets expectations about AI involvement broadly, this clause sets specific expectations about what the AI can decide without you.

What is the biggest legal risk of skipping this clause? If an unsupervised decision causes customer harm and there was no clear prior disclosure of the agent's authority to make that kind of decision, the company has a much weaker position arguing the customer accepted that risk as part of the service.