A Regulator Just Made You Classify Decision Authority. Only Runtime Knows the Class.

On July 15, China's Implementation Opinions on Intelligent Agents came into force, the first national framework written specifically for AI agents. Article 6 asks operators to do something no regulator had required before deployment: classify an agent's decision authority into three tiers. Decisions reserved for a human. Decisions that need prior approval. Decisions the agent may take autonomously. File the classification, pass conformance tests, keep product-recall provisions for sensitive sectors.

Read past the compliance mechanics and something larger just happened. A regulator operationalized decision authority as a legal object, in almost the exact vocabulary The Context Graph has been building for a year. This is not a blog concept anymore. It is law. And in the same article, the law exposes the one thing it cannot itself supply.

The classification is right. Its timing is wrong.

The three tiers are the correct axis. Human-only, approval-required, autonomous is exactly how you should think about what an agent is permitted to decide. The error is not the taxonomy. It is when the taxonomy is resolved.

Article 6 asks you to classify by category of action, before the agent runs. But the tier that actually governs an action is not a property of the action type. It is a property of the case, and the case only exists at runtime. A refund is an autonomous decision until the return window has closed, the policy version it was approved under has been superseded, and the customer's entitlement went stale eleven days ago. At that instant the same action should have dropped to approval-required. Nothing you wrote at design time knew that, because none of it had happened yet.

That is the ownable claim of this memo:

A regulator can force you to classify decision authority. It cannot tell you which class an action actually falls into, because the class is decided by the case, not by the category. A tier assigned before the agent runs is a guess. Applicability turns it into a fact, at the moment of the action.

Decision authority is a runtime property wearing a design-time label

The instinct behind Article 6 is to treat decision authority the way we treat access authority: enumerate it up front, grant it once, audit the grant. That instinct is the same one The Context Graph took apart in agent authorization is not decision authority. Access authority can be pre-assigned because it is a property of an identity and a resource, both of which exist before the run. Decision authority cannot, because it is a property of a specific action against a specific state of the world, and that state is composed at runtime.

So a static three-tier filing has a structural blind spot. It records that "issue refund" is an autonomous-tier action. It cannot record that this refund, at this moment, against this superseded policy, has crossed into approval-required. Two actions of the identical type carry different tiers, and the difference is invisible to any classification written before either one occurred. The filing is not false. It is incomplete by construction, in exactly the way a permission grant is incomplete: it describes a category and calls it a case.

This is the same seam that runs through least privilege. Least privilege assumed you knew the path. Tier classification assumes you know the class. Agents decide both at runtime.

Only the decision boundary can compute the tier

If the real tier is a function of the case, then the tier has to be evaluated where the case exists: at the moment of the action, before it reaches a system of record. That evaluation point has a name. It is the decision boundary, the control point that judges whether an agent's proposed action should proceed before it touches an external system.

Concretely, the agent proposes an action, and the boundary re-derives its tier against current, structured context: is the governing policy still in force at decision time, does the entitlement still apply, has the window closed, is this within scope for this entity right now. The outcome is not a static grant consulted once at session start. It is a judgment against the specific action, with human-only, escalate, or allow as live outcomes, plus the reason it decided that way. That is pre-execution enforcement doing the work the filing points at but cannot perform.

Making that judgment computable is what a decision context graph is for. It holds policy versions, entitlement facts, contract terms, and approval history as connected, queryable state, so "which tier applies to this action, in this context, at this version" is a query answered before the write, not a forensic reconstruction after it. It also produces the causal decision trace an auditor will eventually demand: not "the agent was classified autonomous," but "this action was evaluated as approval-required at 14:02 because the policy in force had been superseded." That trace is what turns a classified agent into an accountable agent, one whose every action carries its justified tier rather than a design-time label.

Where this goes by mid-2027

Here is the dated prediction. By mid-2027, compliance with decision-authority-classification regimes, China first and its imitators after, will force a runtime applicability layer, because static classifications will start failing audits. The trigger will be predictable: an action filed as autonomous causes a harm that a contextual check would have escalated, an auditor asks how the tier was re-evaluated at decision time, and the filing has no answer. "Show me how you re-classify the tier at the moment of the decision" becomes an RFP line and an audit question, sitting next to "where is your SSO."

The buying question inverts with it. Today the compliance question is "have you classified your agents' decision authority." In eighteen months it becomes "show me the layer that decides, action by action, which class you are actually in." The regulator created the demand for decision authority. Only the decision boundary can supply it, because only it sees the context the agent composed at runtime.

The reference implementation

Rippletide is one implementation of this boundary. Its Safety Cases evaluate each proposed write-action at the moment of the action and return flag, escalate, or allow with an auditable trace, which is the enforceable version of the tier the Chinese rules require on paper. A filing declares three tiers once, before the run. Rippletide re-derives which tier an action truly falls into, per action, against current context, and records why. It sits above the identity and gateway layers rather than replacing them, because declaring a tier and computing it are different jobs, and only one of them can see the case.

The architectural claim holds independent of vendor and independent of jurisdiction. The law was right to make you classify decision authority. It was wrong to believe the class could be assigned in advance. The class is decided by the case, and the case is only knowable at the decision.

---

The Context Graph is a weekly newsletter for AI engineers building production agents. Read the context graph glossary for the canonical vocabulary behind the decision boundary, applicability, pre-execution enforcement, accountable agents, and decision context graphs.