The foundation
In most organizations, who can decide what is captured in approval matrices, delegation policies, and tribal knowledge. Agents cannot read tribal knowledge. They require explicit, encoded decision rights: this agent can spend up to this amount in this category for this purpose; this agent must escalate if these conditions are met; this agent’s actions are reviewable by this role within this timeframe.
Encoding decision rights is not a technical exercise. It surfaces ambiguities that organizations have lived with comfortably for years — who really owns this call, what the actual approval thresholds are, when policy is followed and when it is quietly bypassed. The encoding process is often the most uncomfortable part of an autonomy programme, and the most valuable.
What it gives you
A machine-readable policy is a policy that holds. The work of encoding forces conversations that were overdue — the unwritten escalations, the inconsistent thresholds across business units, the approvals that were nominal because the approver never had time to read. Those conversations are uncomfortable, and they are exactly the conversations that protect the organization when an agent acts inside the encoded boundary and the boundary turns out to be the wrong one.
The benefit shows up twice. The first time, in a documented framework that an agent can act on without a human shadowing every step. The second time, in a control environment that auditors, regulators, and boards can examine without depending on the institutional memory of three specific people.
Where it sits
Decision rights sit between the data foundation and the workflow foundation. Without trustworthy data, encoded decisions act on the wrong inputs. Without encoded decisions, redesigned workflows cannot run without a human gate at every step — which defeats the redesign.
In the five-level autonomy model, the move from Level 2 to Level 3 is exactly the move from humans approving each task to humans setting policy and handling exceptions. The policy has to exist in a form the agent can read for that move to be real. Until then, what looks like autonomy is automation with longer queues.