Bounded authority in agentic systems

Extraction produces values that fail validation. An analyst then has to open the source document, hunt through appendices and reference tables, and work out what went wrong. That resolution work, not the extraction itself, was the bottleneck.

A user invokes an agent on a specific flagged field, optionally with a hint about where to look. The agent assembles context from the existing extracted values, the validation flags, the linked entity record, and enrichment data. It retrieves the most relevant text blocks and tables, then chooses between deterministic capture tools (column, text, anchor) and LLM-powered extraction (context based, multi hop, map reduce). Deterministic validation rules then re-run on the result.

Three layers, separated on purpose. The agent reasons. Deterministic rules validate. The human decides. The agent never judges its own output and never writes autonomously. It also distinguishes an extraction error it can propose a fix for from a genuine problem in the source document, which it escalates rather than correcting into looking right.

For every capability, ask what it costs if this is wrong. High cost stays deterministic or human gated. Low cost can go to the agent.

The escalation path treats every unresolvable case the same way. In practice some escalations are routine (a source document is genuinely ambiguous) and some are signals that a whole document type needs a new extraction pattern. I'd want the agent surfacing that second category differently, as a pattern level signal rather than a one-off flag, so the fix compounds instead of repeating.