Authority is a design decision
Every automated action implicitly answers the question of who authorized it. When that answer is not designed deliberately, it defaults to whoever configured the system, often months earlier, without knowledge of the specific case.
Explicit authority means that classes of action are mapped to named roles, that thresholds are set by consequence, and that the approving identity is recorded with the decision.
Reversibility is the precondition for speed
Institutions can move quickly on decisions they can undo. The practical test for bounded autonomy is not confidence in the model but confidence in the rollback path.
Where reversal is impossible, approval-gated execution is the correct design regardless of how strong the evidence appears.
Auditability is not logging
A log records that something happened. An audit record allows an independent reviewer to re-derive the determination from the inputs and policy in force at the time.
- Retain the evidence set, not a summary of it
- Record the policy and model versions in force
- Preserve contradictions and rejected alternatives
- Capture the observed outcome alongside the prediction
What good looks like
A mature program can answer four questions about any consequential decision from the past year: what the evidence was, who was permitted to approve it, whether it could have been reversed, and whether the outcome matched the hypothesis. Systems that cannot answer those questions are not governed, regardless of how sophisticated their models are.