You got out of the dugout. You started with the work. You turned it into a practice. You stopped asking whether we used AI and started asking better questions instead.
Here’s why that groundwork is about to matter more than it looks like it does today.
In July 2025, an AI coding agent from Replit deleted a live production database holding more than 1,200 executive records. The person using it had explicitly told the system to freeze: no code changes, no actions in the production environment. The agent acted anyway.
AI getting something wrong isn’t news anymore.
What makes this one worth sitting with is that the AI could act on the mistake.
That is the line organizations need to start paying attention to now: the distance between what AI can recommend and what we authorize it to do.
That distinction, between a system that’s wrong and a system that’s wrong and empowered to do something about it, is exactly what a working group inside the American Bar Association has been wrestling with. I’ve had the chance to listen in on some of that work: a discussion draft on governance for autonomous and agentic systems, circulating through the ABA’s Autonomous Systems Governance Working Group.
It isn’t an official ABA position. It’s a few steps ahead of where philanthropy is today. And the questions it’s asking are more practical than they sound.
What authority have we actually given the system?
Who’s responsible for that delegation?
What stops it from doing something it isn’t authorized to do?
What happens when the situation changes between approval and action?
Can we reconstruct what happened afterward?
In philanthropy, we’re experimenting with general-purpose AI assistants like Copilot and Claude. We’re using AI to draft, summarize, and make sense of data. But autonomous agents, systems that can determine what to do next and then act, aren’t yet common in our sector.
Good.
That means we get to build the muscle before we need it, instead of after.
Everything you’ve already built points here
If you’ve been following along, notice what you’re standing on.
Finding the work told you where AI was showing up.
Writing a practice guideline told you what was actually happening inside that work.
Rethinking disclosure told you how to ask what actually matters instead of a yes-or-no question that stopped meaning anything.
None of that was really about today’s tools.
It was about learning to see the work clearly enough to notice when something important changes.
Where did the judgment shift?
That’s the question that starts to matter a great deal more once AI can act on what it decides.
We’ve been automating things forever
Automation itself isn’t new. Think about your grants management system.
A nonprofit submits an application. An email lands in a program officer’s inbox: ready for review.
A report comes due. The system sends a reminder.
We set the rule in advance: when X happens, do Y.
Now change the scene slightly.
An application comes in. AI reads it, decides an answer is thin, figures out what follow-up it needs, writes the question, and emails the applicant.
You didn’t tell it to send that particular email. You gave it a goal and some room to figure out the rest.
That’s a different game.
But look closely at why it’s different.
The system didn’t just automate the email.
It decided the answer was insufficient.
It decided more information was needed.
It decided what information to request.
And then it acted on those judgments.
The important change isn’t simply that AI entered the workflow.
The judgment shifted.
The line between automating a step and delegating judgment isn’t always obvious, and it’s going to get blurrier. But the governing questions stay pretty simple:
What is the work?
What is the AI doing?
Where did the judgment shift?
And what have we actually authorized AI to do with that judgment?
Follow the grant lifecycle forward
You don’t need science fiction to see where this goes.
A nonprofit uses AI to help prepare its application. A foundation uses AI to review it. AI identifies something missing and recommends a follow-up. Eventually, perhaps that system is allowed to send the follow-up itself.
Later, AI helps analyze the response and recommends a funding decision.
A recommendation could someday trigger another action.
Each step, considered on its own, can sound reasonable.
To be clear, that is not where philanthropy is right now. Humans still sit between most of these steps, and that matters enormously.
But governance decisions accumulate.
We can delegate one seemingly administrative step at a time and eventually discover that we have delegated something much larger.
At what point did we hand over more than administrative work?
Where did our agency go? And in a sector built on relationships, where did the relationship go?
A recommendation is not an action
This is one of the distinctions in the ABA discussion that I think is worth carrying into philanthropy now.
A recommendation is not an action.
An AI recommending that you fund a grant is one thing.
A person reviewing that recommendation and authorizing the grant is another.
A system triggering the payment is another thing entirely.
Governance has to distinguish between what AI proposes, what gets authorized, and what actually gets executed.
That’s not futuristic thinking.
We already make decisions about authority throughout our organizations. Who can approve a grant? Who can sign a contract? Who can release a payment? Who can communicate something consequential on behalf of the institution?
AI doesn’t make those questions obsolete.
It makes it more important that we’ve actually answered them.
The Script
This is why I keep pushing organizations toward practice guidelines, not just a broad AI policy sitting in a drawer.
And lately I’ve started calling the Practice Guideline something simpler:
the Script.
Because that’s really what it is.
It tells us what the work is. What the AI is doing. What the human is doing. Where judgment sits. Who has authority. What gets documented. And when the workflow needs to stop.
A policy might tell us that human oversight is required.
The Script tells us what that means when AI is helping review a grant application.
Go back to our follow-up example.
Can AI draft the follow-up question?
Can it decide that a follow-up is necessary?
Can it determine what information is missing?
Can it contact the applicant directly?
Who owns that communication?
At what point does a person have to step in?
What gets documented?
What makes the workflow stop?
Those are different decisions. Different acts of judgment. Different levels of authority.
The Script makes them visible.
That’s useful governance for the AI-assisted work we’re doing today. It also gives us something we will need if those workflows become more agentic tomorrow.
If we have already documented the work, we can look at each step and make an intentional choice:
AI can do this.
A person does that.
AI can recommend here.
A person authorizes here.
The workflow stops here.
We aren’t trying to invent boundaries after a system starts acting.
We’re deciding them before we delegate.
What good practice was always building toward
This is why another idea in that ABA discussion draft stopped me: minimum organizational competency.
The argument, in plain terms, is that having an AI policy isn’t governance. Putting a human somewhere in the loop isn’t governance either.
Real governance means an organization can show that it’s actually capable of overseeing the systems it hands authority to.
Someone owns the work. The right expertise is in the room. The process is documented. There are real controls. The right people are coordinating across functions. And there’s evidence that the whole thing works the way it’s supposed to.
I preach versions of this constantly.
Not because your foundation needs an autonomous-agent governance program next quarter.
Because these are the building blocks of responsible AI governance, full stop, whether the system drafts a first pass at a report summary or someday takes an action on its own.
And once you put those competency ingredients next to the Script, they stop feeling abstract.
Accountability becomes a named owner.
Expertise becomes the right people at the table.
Documented process becomes the Script itself.
Controls become clear boundaries and a real escalation point.
Coordination becomes your AI committee, or whatever cross-functional review structure you’ve built.
Evidence becomes a way to check whether the practice still matches what you intended.
You don’t need to become an AI governance expert to own a practice.
Your organization has to become competent.
That’s a different, more achievable bar.
Don’t fund capability without funding competency
There’s another reason this matters for philanthropy specifically, and it’s not a technical one.
Power is already shaping who gets to participate in this transition and on what terms.
Back in 2024, I argued alongside Joanna Drew, Ravit Dotan, and Mark Greer II that philanthropy needed to fund more than access to AI. Nonprofits needed the capacity to actually manage its adoption.
That case has only gotten stronger as the technology has moved from generating toward acting.
Governing an AI-enabled workflow well takes real capacity: someone with time to understand the tool, someone who owns the practice, people who can push back on a vendor’s claims, an organization that can document its process and respond when something breaks.
And it takes enough knowledge and enough standing in the room to say, plainly:
No. We aren’t delegating that.
Organizations with deeper resources will get to have that conversation.
Organizations running on thin, restricted funding and a skeleton tech stack may not.
If philanthropy hands nonprofits increasingly capable AI systems without also funding the competency to govern them, we haven’t closed the access gap.
We’ve just relocated it.
We’re early. Let’s move with intention.
Most of us aren’t anywhere near needing a forty-page autonomous-AI policy for technology our organizations don’t use yet.
That’s genuinely good news.
But being early is only an advantage if we use it.
Start with the work.
Write the Script.
Name the owner.
Look for where judgment sits and where it has shifted.
Separate recommendation from authorization and action.
Draw the boundaries.
Decide what makes the workflow stop.
Keep enough evidence to know whether what you intended is actually what’s happening.
And when you fund a nonprofit to adopt something more capable, fund the competency to govern it right alongside the access.
The question in front of philanthropy was never only whether we’ll use AI.
It’s what we’re willing to hand it, where we’re willing to let judgment move, and whether we’ve built the organizational muscle to stay accountable for what happens after we do.
We’re early enough to get this right.
Ready to talk?
If your organization is trying to figure out what it is ready to hand to AI, and what should stay firmly with people, that’s the work I’m doing with foundations and nonprofits right now.
I work with COOs, executive leaders, boards, and grants management teams to build the practices, boundaries, and organizational competency responsible AI delegation requires. Not a policy nobody reads, but a clear Script for what AI can do, where people retain judgment, and what your organization isn’t ready to hand off yet.
Sources & Further Reading
ABA Autonomous Systems Governance Working Group, Proposed Governance Norms and Minimum Organizational Competencies for Autonomous Systems and Agentic AI, discussion draft, not an official ABA position
Ars Technica, “AI coding assistants chase phantoms, destroy real user data” (July 2025)
Center for Effective Philanthropy, “Responsible AI: How Philanthropy Can and Should Support the Movement”
About the Author
Rachel Kimber is managing director of Full Circle Impact Solutions, where she helps foundations and nonprofits build the infrastructure to use AI effectively, ethically, and in service of mission. She works with boards, leadership teams, and grants management staff to align technology adoption with institutional values.
She is faculty for PEAK Grantmaking’s Practical AI for Grants Management Learning Series and NTEN and TAG’s certification programs. Rachel co-created the Stuck to Strategic Framework and speaks internationally on AI, governance, and organizational strategy.