An agent that can act is a different product from an agent that can answer. The moment it writes to a system of record, the cost of being wrong stops being embarrassment and starts being money.
We draw the line by reversibility. Anything a human can undo in one click, the agent may do unattended. Anything that touches a customer, a ledger, or a legal record waits for a person.
The interesting design work is in the waiting. A queue nobody reads is worse than no automation at all, so the handoff has to arrive where the work already happens, with enough context to decide in seconds.