What's an action you still won't let an AI agent perform autonomously in production?

I'm specifically interested in agents that can do things , not just generate answers. If you have an agent that can technically execute some action — modify a database, issue a refund, deploy code, change infrastructure, update a CRM, send something externally, etc. — but you still require a human to approve or perform it, what's stopping you from giving the agent autonomy? I'm especially curious about cases where the model itself is capable enough, but the surrounding system isn't trustworthy enough. Was there a particular failure you were worried about or actually experienced? And what would