Decision Rights Before Delivery

Abstract

The September 2026 Lean Intake Analysis™ research paper defined the decision-readiness gap as the space between organizational attention and a defensible commitment. This paper examines the next governance question: who has authority to make that commitment, what evidence must inform it, and what happens when authority or evidence is insufficient? The paper argues that decision rights should be treated as an explicit enterprise-intake capability rather than as an implicit feature of hierarchy, meetings, or project sponsorship. Drawing on public guidance from the Project Management Institute (PMI), the National Institute of Standards and Technology (NIST), and 2026 research from Deloitte, Microsoft, and IBM, it proposes a public Lean Intake Analysis decision-rights model that distinguishes the decision owner, domain authority, decision contributor, condition owner, escalation authority, and review trigger. The model is designed to support faster decisions by clarifying authority and evidence before work enters delivery. It does not publish proprietary LIA scoring logic. The paper also addresses conditional approval, escalation, re-review, and the emerging need for dynamic decision rights when AI agents participate in organizational work. The central proposition is that governance speed depends less on minimizing oversight than on making authority, conditions, and escalation paths visible before the organization commits capacity or risk.

Keywords: decision rights, enterprise intake, governance, decision readiness, portfolio management, AI governance, escalation, accountability

Research status

This is a conceptual Smith & Welch LLC thought-leadership paper. The proposed constructs are intended for empirical testing in future LIA research and should not be interpreted as independently validated causal claims.

1. From readiness to authority

An enterprise can possess enough information to make a decision and still fail to decide well if authority is unclear. A request may have a defined problem, an accountable sponsor, known risks, and credible evidence, yet stall because several functions believe they have approval authority - or advance because no function believes it does. Decision readiness therefore answers only part of the upstream governance problem. The other part is decision authority.

PMI governance guidance treats roles, responsibilities, decision-making, and escalation as core elements of governance. Its portfolio-management guidance likewise frames authorization as a formal act that communicates selection decisions and allocates resources. Lean Intake Analysis™ extends that principle to the front end of work: before delivery begins, the organization should know which decision is being made, who owns it, which domains can impose constraints, and where unresolved conflicts go next (PMI, 2016; PMI, 2017).

Core distinction: Decision readiness addresses whether the organization has enough context to decide. Decision rights address who may decide, who may constrain the decision, and how unresolved authority is escalated.

2. Why decision rights become ambiguous at intake

Enterprise requests commonly cross business, technology, finance, architecture, security, legal, compliance, procurement, data, operations, and risk boundaries before anyone has formally defined the initiative. This is precisely when decision rights are most vulnerable to ambiguity. The request is important enough to attract attention but not yet structured enough to inherit the mature governance model of a funded program or product.

The problem becomes more visible as technology ownership decentralizes. IBM reported in 2026 that 70% of surveyed technology executives said business teams were deploying technology faster than IT could track; two-thirds said they were accountable for AI systems they did not fully control, and only 11% said they were completely prepared for the expected scale of AI-agent deployment (IBM, 2026). These findings are specific to the surveyed technology leaders, not a universal measure of all enterprises, but they illustrate the governance pressure created when execution authority spreads faster than formal accountability.

Microsoft reported a related organizational gap: in its 2026 Work Trend Index survey of 20,000 AI users across 10 countries, only 19% fell into its high-capability, high-readiness “Frontier” zone and only 26% said leadership was clearly and consistently aligned on AI. Microsoft explicitly notes that these readiness measures are self-reported associations, not causal estimates (Microsoft, 2026).

3. Decision rights are more than a RACI

RACI and similar responsibility models remain useful for clarifying who is responsible, accountable, consulted, and informed. Intake governance, however, requires a more precise question: who has the authority to make this particular decision at this particular level of consequence? A person may be accountable for an initiative but lack authority to accept a cybersecurity exception, commit capital, approve a regulated-data use, or authorize a production deployment.

Deloitte’s 2026 work on AI and decision-making argues that decision rights will need to become more dynamic as humans and AI agents share work. It recommends explicit override privileges, escalation paths, and consensus rules rather than relying only on static person-centric role models. Deloitte also found that 60% of executives in its 2026 Global Human Capital Trends survey reported regularly using AI to support decisions, while only 5% of respondents considered their organizations to be leading in this area (Deloitte, 2026a).

The practical implication for enterprise intake is that authority should attach to a defined decision, not merely to a meeting invitation, job title, or project role.

4. A public LIA decision-rights model

The model is deliberately role-based rather than title-based. In one organization the decision owner may be a product executive; in another it may be a portfolio council, business unit leader, or delegated investment authority. The methodology requires clarity of authority, not a universal organization chart.

5. Decision authority should be proportional to consequence

Not every request warrants executive approval. Requiring senior governance for reversible, low-cost, low-risk experiments can create unnecessary queue time. Conversely, allowing a local team to authorize an irreversible customer, regulatory, capital, or enterprise-platform commitment can create unmanaged exposure. Decision rights should therefore be calibrated to the consequence of the decision rather than the visibility of the requester.

A proportionate model considers at least four attributes: reversibility, scale of organizational commitment, risk or regulatory consequence, and the breadth of functions materially affected. The objective is not to assign a numeric formula in public guidance. It is to make the logic visible enough that teams know when local authority is sufficient and when a higher level is required.

NIST provides an external parallel in AI risk management. Its AI RMF Map function is intended to establish enough contextual knowledge to support an initial go/no-go decision; the framework also notes that risk tolerances should inform whether development or deployment should continue. The principle is transferable: the rigor and authority of the decision should match the consequences that the organization is accepting (NIST, 2023).

6. Conditional approval is a governed decision

Organizations often face requests that are sufficiently ready to advance but still contain unresolved items. The governance failure is not necessarily proceeding with uncertainty; the failure is proceeding without making that uncertainty explicit and owned. Lean Intake Analysis™ therefore treats Proceed with conditions as a distinct decision state rather than as an informal approval.

A condition should identify four things: the condition itself, the owner, the evidence or event that will demonstrate satisfaction, and the consequence or review action if the condition is not met. These elements prevent conditional approval from becoming an undocumented transfer of unresolved decision work into delivery.

A useful test is simple: if the organization cannot state who owns a condition and how leaders will know whether it was satisfied, the condition is not yet governed.

7. Escalation is a governance path, not a failure

Escalation is appropriate when the decision exceeds delegated authority, when domain authorities conflict, when a required exception is outside a reviewer’s remit, when the consequence changes materially, or when the organization cannot resolve a condition within the current decision boundary. In these circumstances, escalating quickly can preserve speed by preventing a request from circulating through repeated meetings without a legitimate decision-maker.

The escalation record should preserve the original decision question, the unresolved conflict or threshold, the evidence already considered, and the authority required next. Escalation should not restart intake from zero unless the underlying request materially changes.

8. Re-review protects decisions from becoming stale

A decision is valid within a context. When that context changes, the organization may need to revisit the decision. Re-review is therefore not synonymous with recurring bureaucracy. It is a mechanism for recognizing that the evidence, risk, scope, dependency, or authority supporting a prior decision may no longer be sufficient.

Common review triggers include a material scope expansion, a new regulatory or security requirement, a failed dependency, a large change in cost or benefit assumptions, movement from experiment to production, a significant increase in AI-agent autonomy, or expiration of a time-bounded exception. The trigger should be defined when the decision is made whenever possible.

9. Dynamic decision rights for AI-enabled work

AI intensifies the need for explicit decision architecture because systems can increasingly recommend, initiate, and execute actions at machine speed. Deloitte argues that organizations should define where AI may decide, where humans must approve, who can override, and how disagreements are logged and escalated. Microsoft similarly emphasizes documented human handoffs, quality standards, and organizational readiness as firms scale agent use (Deloitte, 2026a; Microsoft, 2026).

For enterprise intake, this means that an AI-enabled request should identify not only the human business owner but also the boundary of machine authority: what the system may do autonomously, what requires human sign-off, what evidence must be retained, and what conditions trigger intervention. These decisions belong upstream because autonomy is part of the operating model being approved, not merely a technical implementation detail.

10. Organizational implications

• Executives: define delegations of authority that allow reversible decisions to move quickly while reserving higher-consequence choices for the appropriate level.
• PMO / EPMO and portfolio leaders: make decision ownership, conditions, escalation, and re-review visible in intake records before work becomes a portfolio commitment.
• Architecture, security, legal, finance, data, and risk functions: distinguish advisory input from domain authority so teams know when a recommendation is optional versus binding within delegated scope.
• Product and business leaders: separate sponsorship from decision authority and identify who owns outcome, funding, risk acceptance, and operating accountability.
• AI governance leaders: document the decision rights shared between humans and agents, including override and escalation mechanisms.

11. Research propositions

Future LIA research should test whether decision-rights clarity is associated with measurable enterprise outcomes. Candidate propositions include:

• Requests with an explicitly named decision owner will show shorter time-to-decision than requests that rely on committee ownership alone.
• Conditional approvals with named condition owners and review triggers will show fewer late-stage escalations than informal approvals containing unresolved dependencies.
• Predefined escalation authority will reduce the number of governance handoffs required for cross-domain requests.
• Decision-rights clarity will be more strongly associated with intake cycle time for cross-functional and AI-enabled requests than for low-risk local work.
• Requests that cross from experiment to production with an explicit re-review trigger will show stronger traceability of risk and ownership than those that scale without a formal decision point.

12. Conclusion

Decision readiness answers whether the enterprise has enough context to make a responsible choice. Decision rights answer who can make that choice, which authorities can constrain it, and what happens when the existing authority is insufficient. The two capabilities are inseparable at the front end of work.

A fast intake model is not one that removes governance. It is one that makes governance legible: the decision is named, the owner is known, domain authority is explicit, conditions are owned, escalation is pre-routed, and material changes trigger re-review. In that environment, speed comes from reduced ambiguity rather than reduced accountability.

References

• Deloitte. (2026a, March 3). AI and the future of human decision-making. Deloitte Insights. https://www.deloitte.com/us/en/insights/topics/talent/human-capital-trends/2026/decision-making-with-ai.html
• Deloitte. (2026b, June 29). Rewiring the enterprise operating model for AI scale. Deloitte Insights. https://www.deloitte.com/us/en/insights/topics/technology-management/rewiring-ai-operating-model.html
• IBM. (2026, June 8). New IBM study finds CIOs and CTOs face growing AI control gap as enterprise deployment scales. IBM Newsroom. https://newsroom.ibm.com/2026-06-08-new-ibm-study-finds-cios-and-ctos-face-growing-ai-control-gap-as-enterprise-deployment-scales
• Microsoft. (2026, May 5). 2026 Work Trend Index Annual Report: Agents, human agency, and the opportunity for every organization. https://www.microsoft.com/en-us/worklab/work-trend-index/agents-human-agency-and-the-opportunity-for-every-organization
• National Institute of Standards and Technology. (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf
• Project Management Institute. (2016). Governance of portfolios, programs, and projects: A practice guide. PMI.
• Project Management Institute. (2017). The Standard for Portfolio Management (4th ed.). PMI.
• Smith & Welch LLC. (2026a). The decision-readiness gap: Why work enters delivery before the organization is ready to make the decision (LIA Research Paper 2026-01). Lean Intake Analysis™.
• Smith & Welch LLC. (2026b). Methodology Update 2026.09: Defining decision readiness before delivery. Lean Intake Analysis™.