Agent autonomy policy
Decide which actions may proceed autonomously and under what conditions
When an agent is being allowed to act with less human intervention, this area becomes relevant. For the business owner accountable for agent actions, the concern is specific: an autonomy policy defines broad levels but cannot decide whether a particular action is permitted. The governance implementation design starts from that consequence and follows the relevant evidence through the customer workflow. Autonomy should be expressed through permissions and conditions people can apply. The policy should identify when an agent must stop, request a new decision, or lose authority because the task or surrounding facts changed.
Connect the operating question to inspectable evidence
- Business owner accountable for agent actions
- Owns the bounded decision and the consequence of acting.
- Action catalogue
- Defines the starting context for the proposed work.
- Authority thresholds
- Exposes the first material uncertainty to examine.
- Escalation and renewal rules
- Carries unresolved conditions into an accountable next action.
Decision at stake
Decide which actions may proceed autonomously and under what conditions
Make the decision explicit
- Business owner accountable for agent actions
- An agent is being allowed to act with less human intervention.
- Decision
- Which actions may proceed autonomously and under what conditions.
- Authority thresholds
- Use action catalogue to establish the relevant starting condition.
For the business owner accountable for agent actions, this becomes relevant when an agent is being allowed to act with less human intervention. The immediate decision is which actions may proceed autonomously and under what conditions. The scope should be narrow enough that the governance owners can identify a meaningful alternative, including continuing the current approach if the available evidence already supports it.
The practical failure to challenge is that an autonomy policy defines broad levels but cannot decide whether a particular action is permitted. That concern gives the work a concrete direction: establish what the relevant boundary should do, inspect how it behaves or would operate, and identify the owner of any gap. It should not be diluted into a broad transformation exercise before the specific question has been answered.
Coverage
Examine authority thresholds alongside changing context
Keep the review distinctions visible
- Authority thresholds
- Bind permission thresholds to the consequence of the actual action.
- Changing context
- Reassess authority when the task, recipient or effect changes.
- Suspension and renewal conditions
- Define when permission expires, is suspended or needs renewed approval.
Authority thresholds
For this scope, authority thresholds should be examined alongside action catalogue. Map authority to specific actions and conditions. A useful autonomy policy can distinguish drafting from sending and preparing from committing. The proposed matrix should identify what evidence or approval must exist before execution rather than rely solely on broad autonomy levels.
Changing context
For this scope, changing context should be examined alongside impact and reversibility analysis. Test how changed facts affect previously granted authority. A different target, payload, recipient, or task scope may require a new decision. The policy should state which changes invalidate approval and which can proceed within the original conditions, leaving no need for the agent to invent that boundary.
Suspension and renewal conditions
For this scope, suspension and renewal conditions should be examined alongside human approval model. Define suspension, expiration, and renewal for ongoing work. The policy should explain what happens when a task waits, an owner changes, or a permission is revoked. A long-running agent should not treat an initial authorisation as permanent permission for every later interpretation of the task.
Prerequisites
Start with action catalogue
Give each input a specific job
- Action catalogue
- Defines the operating boundary.
- Impact and reversibility analysis
- Examine changing context.
- Human approval model
- Shows conditions affecting suspension and renewal conditions.
- Policy or risk owner
- Confirm access and a reviewer who can resolve gaps.
The starting material is action catalogue, impact and reversibility analysis, and human approval model. Review these together rather than assuming one document tells the whole story. A stated rule may differ from a configured behaviour, and a proposed responsibility may not yet have an available owner. Identify those differences before selecting the detailed work.
Participation should include an accountable policy or risk owner, relevant system owners, and qualified legal or domain reviewers when interpretation is needed. The customer should define which information and environments may be used. Synthetic or sanitised examples can support preparation when they preserve the relevant behaviour; if they omit a material dependency, record the limitation and agree how the missing evidence would be obtained.
How the work proceeds
Follow the requirement into an accountable operating practice
Follow the evidence through the work
- Authority thresholds
Use action catalogue to define the decision criteria.
- Changing context
Inspect impact and reversibility analysis and retain observations that challenge the expected result.
- Suspension and renewal conditions
Use human approval model to identify unresolved conditions and a responsible owner.
- Escalation and renewal rules
Link the recommendation to its evidence, remaining limits and next validation condition.
Create an action matrix that distinguishes permission to propose, prepare, approve, and execute. Add conditions such as required evidence, valid human authorisation, and current role membership. The proposed policy should define what changes invalidate those conditions, including a different recipient, larger scope, or expired task context.
A practical first slice would focus on authority thresholds and then follow its consequences into changing context. Keep suspension and renewal conditions visible as a separate review question rather than assuming it is satisfied by the first result. The governance owners should record observations, competing explanations, and changes to the original assumptions. A second reviewer can challenge whether the evidence supports the recommendation and whether an apparently successful example omitted the condition that matters most.
Indicative artefacts
Use escalation and renewal rules to make the next action explicit
Every artefact needs an operating use
Illustrative working format
- Autonomy policy draft
- Boundary — action catalogue.
- Action authority matrix
- Findings about changing context.
- Escalation and renewal rules
- Action on suspension and renewal conditions.
Indicative outputs include autonomy policy draft, action authority matrix, and escalation and renewal rules. Their form should follow the decision and the customer’s existing operating records. The first should establish the assessed boundary and relevant observations; the second should make material gaps or dependencies inspectable; the third should identify the action, owner, and evidence needed to revisit the decision.
Acceptance should be tested through use: can the responsible owner explain what was examined, identify an unresolved issue, and act on the next step without reconstructing the whole engagement? Findings should preserve counterevidence and limits. A polished document is insufficient if it does not help resolve the customer’s specific question.
Illustrative scenario
Drafting permission: approval or refusal
Examine the constructed decision boundary
Illustrative scenario
- Drafting permission
A service agent may compose replies without separate authorisation.
- Account-setting request
Introduce a task that would change the customer's account.
- Approval or refusal
Require the action-specific route; drafting permission must not silently authorise the change.
Consider an illustrative situation in which a service agent may draft responses freely but needs specific authorisation before changing account settings. This is a constructed example, not a client engagement or an observed Softlander outcome.
For the service agent, an illustrative case would begin with an authorised draft and then introduce a request to change an account setting. The policy should produce a clear route to approval or refusal. This tests whether autonomy categories lead to operational decisions rather than simply describe broad aspirations.
The useful learning would be the difference between the expected behaviour and the behaviour or responsibility actually demonstrated. If the exercise leaves suspension and renewal conditions unresolved, that should remain a named next step. A recommendation to narrow the scope, improve a prerequisite, or hold the decision can be appropriate when the example exposes a material dependency.
Scope and authority
Governance evidence supports decisions within defined professional limits
Keep analytical work separate from decision authority
- Operating requirements and evidence mapping
- Can include autonomy policy draft.
- Policy or risk owner
- Authorised policy owners decide; qualified specialists interpret professional requirements.
- Legal conclusions and certification decisions
- Cannot be inferred from action authority matrix.
This work supports governance preparation and operating evidence. It does not provide legal advice, determine regulatory compliance, award certification, or replace a formal audit. Authorised customer owners retain policy, release, and residual-risk decisions.
Ways to engage
Related engagement scopes
AI Privacy Engineering Review
Trace personal data through your agent workflow. Examine collection, memory, retrieval, tool access and retention against your agreed requirements.
AI Governance Operating System
Make AI oversight part of daily operations. Connect inventories, accountable owners, change decisions and evidence into a workable governance process.
Continue exploring
Related insights and resources
Governing agent decisions
Governance becomes useful when it changes a decision. Connect each agent workflow to an accountable owner, explicit operating conditions, proportionate evidence and a practical route for exceptions and withdrawal.
Protecting agent data and memory
An agent's information footprint extends beyond the conversation. Map the copies, derived records and retrieval paths that influence future actions, then connect each to purpose, access, retention and verifiable handling.
AI agents in legal operations: assistance without invented authority
Legal agents can organize evidence and prepare work, but professional judgement, client authority and verified legal positions cannot be delegated by interface.