AI Decision Rights: Who Should Be Allowed to Approve, Override or Stop AI?
Artificial intelligence creates a new kind of organisational decision.
It is not simply:
Should we use AI?
As AI becomes embedded into business processes, organisations need to decide:
Who can approve an AI use case?
Who decides what data it can access?
Who determines whether human oversight is required?
Who can increase an AI system's authority?
Who can override an AI-generated decision?
Who can stop an AI system if something goes wrong?
And who decides whether a successful AI initiative should scale?
These are AI decision rights.
They are easy to overlook.
An organisation can have an AI strategy, governance framework, policies and committees while still creating confusion if nobody knows who has authority to make which decisions.
And as AI moves from assisting employees towards making decisions and taking actions, that clarity becomes increasingly important.
Because effective AI accountability isn't simply about knowing who owns AI.
It is about knowing:
Who can decide what, within which boundaries, and when must that decision be escalated?
What are AI decision rights?
AI decision rights define which people or governance bodies have the authority to make specific decisions about how artificial intelligence is selected, approved, deployed, controlled, monitored, changed and stopped.
They establish practical authority across the AI lifecycle.
For example:
Who can approve a low-risk productivity tool?
Who can approve AI accessing customer information?
Who decides whether AI can influence recruitment?
Who can authorise an AI agent to take actions?
Who can suspend a system following an incident?
Without clear decision rights, organisations often compensate through escalation.
More decisions travel upwards.
More committees become involved.
Approvals take longer.
Business teams become frustrated.
And leadership becomes a bottleneck.
Good decision rights should therefore achieve two things simultaneously:
increase control where consequences are significant
and
increase speed where risk is low.
AI ownership and AI decision rights are not the same thing
This distinction matters.
A business leader may own an AI use case without having authority to make every decision associated with it.
Consider an AI system used in Customer Service.
The Customer Service Director might own the business outcome.
Technology might decide which technical architecture is acceptable.
Security might determine access requirements.
Legal might establish particular restrictions.
A governance group might approve higher risk use.
The Board might oversee material risk.
Ownership answers:
Who is accountable for the outcome?
Decision rights answer:
Who has authority to make this particular decision?
Both need to be clear.
For the broader accountability model, read AI Accountability Framework: Who Decides, Who Owns and Who Is Responsible When AI Is Used?
Why unclear AI decision rights slow organisations down
Weak governance is often associated with insufficient control.
But unclear governance can also create too much friction.
Imagine a manager wants to introduce an approved AI tool into a low-risk internal process.
They ask IT.
IT asks Security.
Security asks Legal.
Legal asks Data Protection.
The proposal goes to an AI committee.
The committee asks for executive approval.
Nobody is certain who actually has authority to say yes.
Three months later, the team either abandons the idea or starts using another tool unofficially.
This is not strong governance.
It is unclear decision architecture.
The objective should not be to make every AI decision senior.
It should be to make the right decisions at the right level.
The Stratify AI Decision Rights Model
A practical way to structure AI decision rights is around six decisions:
ADOPT → ACCESS → ACT → OVERRIDE → ESCALATE → STOP
Each requires clear authority.
1. ADOPT: Who can approve an AI use case?
Not every AI application should require executive approval.
A proportionate model might distinguish between different levels of use.
Low-risk AI
For example:
internal drafting;
summarisation;
brainstorming;
low-risk productivity activity using approved tools.
These may be permitted within existing policy without individual approval.
Moderate-risk AI
For example:
customer-facing content;
operational recommendations;
processing internal business data;
workflow automation.
These might require approval from a business owner plus relevant specialist functions.
Higher-risk AI
For example, AI influencing:
significant employee decisions;
financial decisions;
regulated activity;
material customer outcomes;
sensitive data;
autonomous actions.
These may require formal cross-functional or executive approval.
The principle is:
Approval authority should increase with consequence, not simply with technical sophistication.
2. ACCESS: Who decides what AI can see?
Data access is one of the most consequential AI decisions.
An AI system might technically be capable of accessing:
customer records;
employee information;
financial data;
contracts;
emails;
internal knowledge;
commercially sensitive information.
That does not mean it should.
Leadership needs clear authority for deciding:
Which data can the AI access?
For what purpose?
For how long?
Under whose permissions?
Can that information leave organisational systems?
Can the provider retain or use it?
The business owner should not necessarily be able to make these decisions alone.
Data, Security, Privacy and Technology requirements may apply.
But those requirements should be designed into a predictable approval route rather than discovered halfway through implementation.
3. ACT: Who decides what AI is allowed to do?
This becomes critical with AI agents.
There is a significant difference between AI that can:
read information
and AI that can:
change information.
Likewise:
draft an email
is different from:
send an email.
And:
recommend a refund
is different from:
issue a refund.
Organisations therefore need to establish action authority.
A useful principle is:
Give AI the minimum authority required to create the intended business outcome.
Suppose an AI agent manages routine customer refunds.
Leadership might establish:
£0–£25 → agent can act automatically.
£25–£250 → agent recommends; employee approves.
Above £250 → manager approval required.
The exact boundaries will vary.
What matters is that they exist.
The AI Authority Ladder
AI authority can be considered across five levels:
INFORM
AI provides information.
RECOMMEND
AI proposes a decision.
PREPARE
AI prepares an action.
EXECUTE WITH APPROVAL
AI can perform the action after human authorisation.
EXECUTE WITHIN BOUNDARIES
AI can act independently within predefined limits.
The objective is not to move every AI system towards the highest level.
The correct level depends on value, reliability, consequence and control.
4. OVERRIDE: Who can challenge an AI decision?
If AI influences a decision, somebody may need authority to disagree with it.
That sounds obvious.
In practice, organisations can accidentally create workflows where overriding AI becomes difficult.
An employee may think:
“The system probably knows better.”
Or:
“If I override it and I'm wrong, I'll be blamed.”
Or:
“Overriding requires three additional approvals.”
Human oversight is meaningful only when people have genuine authority to intervene.
Organisations should therefore define:
Who can override the AI?
When?
What needs to be documented?
Does an override require escalation?
How are repeated overrides investigated?
Overrides are also valuable information.
If employees repeatedly reject the same AI recommendation, the system or process may need attention.
5. ESCALATE: Which AI decisions need to move upwards?
Not every issue requires executive attention.
But some should.
Escalation triggers might include:
significant customer impact;
regulatory implications;
sensitive employee decisions;
major financial exposure;
unexpected AI behaviour;
repeated control failures;
security incidents;
significant reputational risk.
The escalation path should be defined before an incident occurs.
For example:
Routine exception
→ operational owner
Material control issue
→ governance/risk owner
Significant incident
→ executive leadership
Material enterprise risk
→ Board visibility
The precise model varies.
The important point is that employees should not need to invent an escalation route when something has already gone wrong.
6. STOP: Who has the authority to switch AI off?
This may be the most overlooked decision right.
An organisation deploys an AI system.
Something unexpected happens.
Who can suspend it?
Technology?
The business owner?
Risk?
Security?
The AI committee?
The CEO?
If nobody knows, valuable time can be lost while the organisation debates authority.
Every material AI system should have a defined stop authority.
That person or function should be able to act when predefined conditions are met.
Examples might include:
security breach;
significant inaccurate outputs;
harmful customer outcomes;
regulatory concern;
material performance deterioration;
unexpected autonomous behaviour.
Stopping the system does not necessarily mean abandoning it permanently.
It means the organisation can regain control while the issue is understood.
Decision rights should exist across the AI lifecycle
AI decisions do not stop at initial approval.
Consider the lifecycle:
IDENTIFY
Who can propose an AI opportunity?
↓
APPROVE
Who decides whether it proceeds?
↓
DEPLOY
Who authorises production use?
↓
OPERATE
Who controls day-to-day boundaries?
↓
CHANGE
Who can modify permissions, models or workflows?
↓
SCALE
Who approves wider deployment or investment?
↓
STOP
Who can suspend or terminate it?
A strong operating model makes these decisions visible.
The danger of the AI committee becoming the answer to everything
When accountability is unclear, organisations often create an AI committee.
That can be useful.
But there is a risk that every AI decision begins travelling to the committee.
The result:
more governance
but
slower decisions.
An effective committee should focus on decisions that genuinely require cross-functional judgement.
Routine decisions should be delegated within agreed boundaries.
For example:
Low-risk approved AI use → business function can proceed.
Moderate-risk use → defined approval route.
High-risk or novel use → AI governance group.
Material enterprise decision → executive/Board escalation.
This creates governance by exception.
The Stratify Decision Rights Matrix
For each material AI use case, leadership should be able to complete:
Decision | Who has authority? |
Propose use case | ? |
Approve investment | ? |
Approve AI use | ? |
Approve data access | ? |
Set human oversight | ? |
Set AI authority | ? |
Override AI | ? |
Change permissions | ? |
Approve scale | ? |
Suspend/stop AI | ? |
If several boxes contain:
“Depends”
or
“Committee?”
then the organisation may have a decision-rights problem.
How decision rights change with AI risk
A useful principle is:
Low consequence → decentralise
Higher consequence → increase oversight
This allows organisations to avoid two extremes.
Over-centralised AI
Everything requires approval.
Innovation slows.
Governance becomes a bottleneck.
Shadow AI may increase.
Under-governed AI
Teams make significant decisions independently.
Leadership visibility falls.
Risk increases.
The goal is bounded decentralisation.
Give people authority to act within clearly defined limits.
Escalate when those limits are exceeded.
How decision rights change with AI agents
AI agents make the issue even more interesting because the organisation is effectively delegating some decision authority to software.
An agent may be authorised to:
choose a tool;
retrieve information;
communicate;
modify records;
execute transactions;
trigger another process.
That means leadership needs two layers of decision rights:
Human decision rights
Who can authorise the agent?
and
Agent decision rights
What can the agent decide independently?
This can be expressed simply:
Human authority determines AI authority.
An agent should never acquire greater operational authority simply because the technology is capable of it.
Who should own AI decision rights?
The overall framework should normally be established through executive governance.
But individual decisions may sit across:
Business leaders — business outcomes and process decisions.
Technology — architecture and technical standards.
Security — security requirements and access.
Data/Privacy — appropriate data use.
Risk/Legal/Compliance — specialist requirements.
Finance — significant investment.
Executive leadership — material strategic decisions.
Board — appropriate oversight of material issues.
The objective isn't to make these functions jointly approve everything.
It is to establish where each function has authority and where it provides advice or challenge.
Seven signs your AI decision rights are unclear
1. Routine AI decisions repeatedly reach senior executives
Authority has not been delegated.
2. Different teams give different answers about who can approve AI
Governance is inconsistent.
3. Business teams bypass formal processes
The approval model may be too slow or unclear.
4. Nobody knows who can increase an AI agent's permissions
Authority is being treated as a technical setting rather than a business decision.
5. Employees can theoretically override AI but rarely do
Human oversight may not be meaningful.
6. Every AI use case goes to the same committee
Governance is not proportionate.
7. Nobody can answer who can stop the system
Incident authority is missing.
These are symptoms of a wider accountability problem.
The AI Decision Rights Test
For any significant AI use case, ask:
Who can approve it?
Who can approve the investment?
Who decides what data it can access?
Who determines the level of human oversight?
Who decides what actions AI can take?
Who can override its decisions?
Who can increase its authority?
What triggers escalation?
Who can approve scaling?
Who can stop it immediately?
If those answers are clear, decisions can move faster.
If they aren't, the organisation may have governance without decision clarity.
Good AI governance should make decisions faster
Governance is sometimes presented as the opposite of speed.
It shouldn't be.
Poor governance slows organisations because every new situation requires a new debate.
Strong governance establishes:
the boundaries
the authority
the escalation route
in advance.
Then people can act confidently within them.
This is particularly important as AI becomes more embedded across organisations.
Central leadership cannot approve every AI interaction.
Nor should it.
The scalable model is:
Clear authority + defined boundaries + proportionate escalation + visible accountability.
That is what good AI decision rights provide.
Because as AI becomes capable of making more decisions itself, organisations need to become much clearer about who gave it permission to make them.
Frequently Asked Questions About AI Decision Rights
What are AI decision rights?
AI decision rights define who has authority to approve, deploy, control, modify, override, scale or stop AI systems and use cases within an organisation.
Who should approve AI use cases?
Approval should be proportionate to risk. Low-risk uses may be permitted under existing policies, while higher-risk or more consequential AI may require specialist, executive or cross-functional approval.
Who should be allowed to override AI?
People responsible for meaningful human oversight should have genuine authority to challenge and override AI decisions within clearly defined boundaries.
Who should be able to stop an AI system?
Material AI systems should have predefined stop authority assigned to an appropriate business, technology, risk or security owner depending on the circumstances.
Should every AI decision go through an AI committee?
No. Routine and lower-risk decisions should generally be delegated within agreed boundaries. Committees are more useful for higher-risk, novel or cross-functional decisions.
What are AI agent decision rights?
AI agent decision rights define which decisions and actions an agent can perform independently, which require human approval and which must be escalated.
How can businesses improve AI decision-making?
Clarify ownership, define decision authority, establish risk-based approval thresholds, set escalation routes and ensure people understand the boundaries within which they can act.
How Clear Are Your AI Decision Rights?
Your organisation may have AI policies and governance structures.
But do people actually know who can decide what?
Stratify's Executive AI Accountability Assessment helps leadership teams identify gaps in AI ownership, authority and accountability.
Assess areas including:
Executive accountability
Business ownership
Decision rights
Governance responsibilities
Human oversight
Escalation
Value ownership
Test Your AI Accountability
Because effective AI governance isn't just about establishing rules.
It's about knowing who has the authority to make the decision.
Comments