You Don't Need an AI Policy. You Need Decision Rights.

The whole series in one line: governance isn't a document. It's who decides what.

This is the last piece in the series, so let me put the entire argument in a single sentence. When your AI use gets messy, you don't have a policy problem. You have a decision-rights problem. And no amount of policy will fix a decision-rights problem.

The reflex is immediate and nearly universal. Something goes sideways with AI — a bad output, an over-eager rollout, a team using a tool in a way that makes legal nervous and the instinct is to say “we need an AI policy.” So someone writes a document. It's thorough. It has principles and guardrails. It gets circulated, skimmed once, and filed. And on the ground, nothing changes.

Here's why. A policy is a statement of intent. It describes how you would like people to behave. But behavior inside a company isn't governed by intent, it's governed by who's allowed to decide what, and who's accountable when it goes wrong. If those two things aren't clear, the policy is just a nicely-worded wish.

The previous three pieces in this series were secretly all about this. Ownership, who owns the agent's output. Authority, what it's allowed to decide alone. Escalation, what it kicks to a human. None of those are policy statements. They're decision rights. Real governance is the allocation of decision rights. It always has been, for people, and now for agents.

So here's the reframe. A policy says “use AI responsibly.” Decision rights say “Maria owns the pricing agent; it can adjust prices within 5%; anything beyond that comes to her; she signs off before it goes live.” One of those is a poster. The other is a system. The first makes you feel governed. The second actually governs.

This is also why AI governance is an operations problem, not a legal one. Legal can write the policy — that part's easy. Only operations can assign the decision rights, because doing it well requires knowing how the work actually flows, who's competent to own what, and where the accountability lines already run. Governance is org design pointed at your agents.

So instead of opening a blank document titled “AI Policy,” do this. For every place AI touches your operation, answer the operational questions, not the aspirational ones. Who decides? Who's accountable? What's the boundary? What happens at the edge? Then write those down, not as principles, as assignments. A one-page map of decision rights beats a forty-page policy every time, because a person can actually act on it.

The honest caveat: you may still need a policy, for legal, for compliance, for a customer or regulator who wants to see one on file. Fine. Write it. But don't confuse having written it with being governed. The policy is the artifact. The decision rights are the governance. Keep them in that order and you'll be fine. Reverse them and you'll have a beautiful document sitting on top of the same chaos.

Five pieces, one idea. You don't have an AI problem — you have a governance gap. Governance comes down to three questions, asked per agent. Every agent needs a name and an owner. The failures that hurt are the quiet ones. And underneath all of it: governance was never a document. It's who decides what. Get the decision rights right, and the policy — if you even need it — mostly writes itself.