Autonomy now needs a filed decision policy
How we assure
China’s Implementation Opinions on intelligent agents (Pebblous)
The rules took effect on 15 July, issued jointly by the Cyberspace Administration of China, the National Development and Reform Commission and the Ministry of Industry and Information Technology. Every agent decision has to be sorted into three tiers before deployment: decisions only a human may take, decisions that need approval first, and decisions the agent may take alone. An agent used in healthcare, transport, media or public safety must be filed and pass a compliance test before it goes live.
Risk: China has made explicit what most enterprise AI governance still leaves implicit. The rights an agent holds to decide are not a design choice you discover in production; they are a policy written down before it runs. A three-tier split of authority is something a board can inspect, which a vague assurance that a human is in the loop somewhere is not. A firm selling into China has to file. Everyone else has been handed a template before a regulator writes them a worse one.
Take your three highest-impact agents and write down, for each, which decisions a human must take, which need approval first, and which the agent takes alone. Where that document does not exist, you have an intention rather than a policy.
How we build
AWS Continuum and AWS Context (AWS Summit New York)
Continuum, in gated preview, finds vulnerabilities in the code across an environment and proves which of them could actually be exploited. It then drives a fix through the team’s own process rather than merging a patch on its own. Context builds a graph of what an organisation already knows, so an agent can look up the relationships and rules of the business as it runs instead of guessing at them. Neither of them is a model.
Architecture: both are plumbing for the part of agent deployment that has nothing to do with which model you call. Proving a vulnerability matters before you fix it; giving the agent your own facts rather than letting it infer them. That layer decides whether an agent is safe to give real access to, and it is where AWS has chosen to compete instead of in the model race. Read next to the Chinese rules, the pattern is one thing. Autonomy is becoming a question of paperwork rather than capability, answered as what tier this decision sat in, who approved it, and what the agent knew when it acted.
Ask where your agents currently get their facts about the business. If the answer is the prompt, or the model’s own recall, there is no governed source of truth to show a regulator.