Decision

The Decision-Rights Map

A method for making authority explicit before AI changes the work.
By Wadda Salah Eldin · · 8 min read

Method

AI governance becomes real when people can answer three questions: what may the system do, who remains accountable and what happens when reality falls outside the rule?

Problems often begin before the model acts. A system recommends, a person approves without scrutiny and nobody knows which judgement should be reviewed. The Decision-Rights Map gives a team a shared language for placing work before it is automated.

It is a conversation method, not a universal scoring model. Every placement must be tested against the organisation’s consequences, controls and obligations.

Two questions

Impact asks what happens if the output is wrong. Reversibility asks how completely the organisation can undo the consequence. Together, they create four operating modes.

High impact · low reversibility: human decides

For strategic or durable consequences, AI can provide analysis and scenarios, but a named person retains authority and accountability. Hiring, compensation, capital allocation and legal posture may belong here, depending on context.

High impact · high reversibility: collaboration

AI proposes, scores or explains; a person validates, approves and adjusts. Both contributions should be visible. The main risk is rubber-stamping: leaving a person nominally responsible while the model’s recommendation goes unchallenged.

Low impact · low reversibility: AI executes

The system performs an operational task inside defined guardrails. People monitor patterns, handle exceptions and own the escalation path. The danger is silent drift when oversight lapses and small errors compound.

Low impact · high reversibility: full autonomy

For high-volume, low-consequence tasks, the system may act independently inside an auditable boundary. The risk is boundary creep: allowing autonomy to extend into decisions it was never designed to make.

Use it in the room

  1. Name the activity. Choose a real workflow or judgement, not “AI” in the abstract.
  2. Place the consequence. Assess impact and reversibility in this organisation and this context.
  3. Assign authority. State what AI may do, what a person must do and who owns exceptions.
  4. Build the evidence trail. Decide what must be logged, reviewed, challenged and changed.

The value is not the quadrant on its own. It is the leadership conversation the placement requires. Two leaders may assess the same decision differently. That disagreement reveals assumptions about harm, accountability and the organisation’s ability to recover.

Keep the map alive

A placement is a current operating choice, not a permanent property of the technology. Consequences can change as a system reaches more people, draws on new data or begins to influence a different decision. The map should therefore be revisited when scope, evidence or exposure changes.

The method does not replace technical, legal, risk or security review. It helps a leadership team make its position clear enough for those disciplines, and the people doing the work, to act on it.

Start with the disputed work, not the technology.

Evidence

Sources and limits.

Last materially reviewed
October 2026

Basis
A beauthentech working method informed by public AI risk-management guidance.

Boundary
The map is not a validated risk score, legal advice or a compliance determination.

Source
NIST, Artificial Intelligence Risk Management Framework 1.0

Apply the method

Which live decision still has no clear owner?

Discuss a live workflow with us