Keep policy authority when AI agents start making business decisions

Your organization is starting to deploy AI agents into work that used to be done by humans following procedures.

Before agents, Compliance could govern the procedure, the controls, the approval hierarchy, the training and the audit trail around the humans. The decisions were made by people who could be trained on the policy and observed acting on it.

With agents, the same question surfaces on every deployment :

Who determines what the agent is allowed to decide ?

This page is about how Compliance keeps that authority when the agent, rather than a human or an existing business system, participates in the decision.

Keep policy outside the model

The AI team can decide how the agent investigates a case, which tools it uses, what evidence it gathers. Compliance keeps authority over the deterministic rules that govern the outcome.

Knowledge is the surface where the Compliance column lives. It is not a place engineers ship policy to. It is a place Compliance edits directly, without engineering as a gatekeeper.

Decide where AI autonomy ends

Not every governed decision should be automated. Knowledge lets policy determine, per rule and per scope, when the agent may proceed, when it must stop, and when authority must return to a human.

Compliance decides the autonomy boundary at the rule level. That boundary is enforceable at the tool boundary, not a note in a document. See Enforcement for the mechanism.

Change policy independently

Rules are objects Compliance can author and amend without a coordinated release cycle. Each rule carries a business-view :

Single-name concentration

Applies to      : Singapore, Equity
Rule            : Post-trade exposure > 12%
Outcome         : REQUIRE APPROVAL
Effective       : 1 October 2026
Rationale       : Updated concentration policy per MAS guidance
Approved by     : Head of Wealth Compliance
Previous version: pinned to consultations from before this date

Change the threshold. Save. The next agent consultation uses the new value. The previous version is preserved so any past decision still points at the exact policy of its day.

Policy changes can be governed independently of agent releases when the new rule uses context the agent can already acquire. When a rule requires a new field, the agent's required_context loop learns to fetch it. See Progressive context.

Explain every governed decision

"Show me the decision on this case, and why it was made."

The answer is a business-view of the frozen state at decision time :

Decision       : BLOCKED
Case           : C-18273
Decided at     : 15 March 2026, 09:12 UTC

Policy at time : Client Suitability v7

Applicable rules :
  R-182 v4  (allow)
  R-291 v2  (require approval)
  R-817 v6  (block)

Winning rule   : R-817 v6
Reason         : Higher precedence prohibition

Human override : None

Not an approximation. Not derived from logs. The exact rules, versions, precedence and overrides in force at decision time. See Auditability for how the reconstruction works.

Preserve why policy changed, not just what changed

Two audit histories, kept in one place. Compliance teams need both.

Every policy amendment writes a governance act (actor, date, rationale). Every decision writes a Consultation. Neither history is stitched together after the fact ; both are preserved as the decisions and amendments happen.

Govern policy as it evolves

Three lightweight controls Knowledge runs while policy grows :

Where Knowledge's responsibility ends

• Enforcement everywhere in the firm. Knowledge governs the decisions that consume its API. A workflow that hardcodes its own policy logic is invisible to Knowledge. Discovery and adoption of the governed layer is a change-management effort, not a technical guarantee.
• The judgment inside approval decisions. approval_required verdicts still need a human decider. Knowledge routes the case efficiently ; it does not remove the responsibility.
• Free-text policy interpretation. Knowledge produces the verdict deterministically from structured {scope, condition, severity} triples. If your rules today only exist as free text in a document, you still need to translate them into that structured form. Knowledge accepts CSV, Excel, DMN or API input.

Start with one policy area

Pick one policy area your agents are already touching, or about to touch. Formalize the rules in Knowledge. Run in shadow mode against your current process. Measure parity. Cut over when the numbers land.

What is Knowledge ?   ·   Talk to us

Related