Writing your first governance policy

Before you write your first policy, you need answers to three questions. This guide walks you through each one, in order.

1. What is the threshold?

The threshold is the line between autonomous action and human review. Below it, the agent proceeds. Above it, work pauses and a human decides.

How to find the right threshold

Start by asking: what is the worst outcome if this action is wrong and nobody caught it?

• If the answer is "minor and reversible" — set a high threshold. The agent auto-approves most things. Exceptions are rare.
• If the answer is "significant or irreversible" — set a low threshold. More actions escalate. The human is in the loop more often.
• If you are unsure — start low. You can always raise the threshold after you have seen how the agent performs on real work.

Threshold types in Traffic Lights

You can define a threshold on any of the following dimensions:

• Value — a dollar amount, a count, a quantity. "Auto-approve refunds under $500."
• Confidence — the agent’s own certainty score. "Escalate when confidence is below 0.75."
• Risk class — a categorical label. "Escalate anything marked HIGH."
• Novelty — first occurrence of a pattern the agent has not seen before.
• Time — actions outside business hours, or within a defined window.

2. Who reviews?

Every escalation needs a named person or a named role. "Someone in finance" is not a reviewer — it is a gap in your policy.

Naming reviewers

• Name the person, not the team. "Sarah Chen, Finance Controller" not "Finance team."
• Name a backup. If the primary reviewer is unavailable, who gets it next?
• Set a window. How long does the reviewer have before the escalation itself escalates?

Reviewer authority levels

Not every reviewer has the same authority. Traffic Lights lets you tier your reviewers so that higher-value or higher-risk decisions require a more senior sign-off.

3. What auto-approves?

Auto-approval is not a shortcut. It is a deliberate statement that for this class of action, you have enough confidence in the agent's judgment that a human review adds no value.

The auto-approval test

Before marking anything as auto-approve, answer yes to all three:

1. Is the action reversible if it turns out to be wrong?
2. Is the agent’s accuracy on this class of action above your acceptable error rate?
3. Can you explain to a regulator or auditor why human review was not required?

Start narrow, expand deliberately

Your first auto-approve list should be short. The goal is not to minimise human review — it is to ensure that human review is meaningful when it happens. A human who approves everything because auto-approve is too narrow learns nothing about the agent. A human who rarely approves anything because auto-approve is too broad is a rubber stamp.

4. Writing the policy statement

A well-written policy statement is one sentence. If it needs more than one sentence, it is probably two policies.

The template

When [agent] performs [action type],
if [condition is met], then [auto-approve / escalate to named reviewer],
within [time window], otherwise [escalate to backup].

Examples

• When the billing agent processes a refund, if the amount is under $500 and the customer account is in good standing, auto-approve. Otherwise escalate to the Finance Controller within 4 hours.
• When the sales agent drafts a proposal, if it contains non-standard pricing or payment terms, escalate to the Account Manager within 2 hours before sending.
• When the ops agent attempts to delete records, always escalate to the Data Owner regardless of quantity. No auto-approve.

5. After 30 days — review and adjust

Your first policy is a hypothesis. After 30 days of real runs, Traffic Lights will surface the data you need to adjust it.

What to look for

• Escalation rate — if more than 40% of actions escalate, your threshold is probably too low. Raise it.
• Approval rate on escalations — if reviewers approve more than 85% of escalations without modification, the threshold is too low. The human review is not adding value.
• Rejection rate — if rejections are under 2%, either the agent is performing perfectly or reviewers are rubber-stamping. Investigate.
• Time to decision — if reviewers consistently take longer than the SLA window, the window is too short or the reviewer is the wrong person.