What an AI Agent May Decide on Its Own: China’s National Rules

Before handing a process to an AI agent, every executive asks the same question: what will this thing do on its own, and where will it stop and ask a human? While the market answers that differently in every product, China has answered it at the level of a national document.

On May 8, 2026, three agencies — the Cyberspace Administration, the National Development and Reform Commission, and the Ministry of Industry and Information Technology — published the Implementation Opinions on the Standardized Application and Innovative Development of Intelligent Agents. It is the country’s first consolidated document devoted entirely to agents, and it came out two and a half months before Beijing’s ten measures, which I covered separately.

The difference between the two documents is fundamental. Beijing answers the question of what the agent economy earns money on. This document answers the question of what an agent is allowed to do at all — which is exactly why it is more useful to anyone deciding right now where to let an agent into their company. Both rest on China’s State Council “AI+” plan, which I covered earlier.

The definition worth starting from

The document opens with a definition, and it is sharper than most marketing ones: an intelligent agent is a system with autonomous capabilities of perception, memory, decision-making, interaction and execution.

Five capabilities. I read this as a working filter for conversations with vendors — with one caveat: the document does not state that all five are mandatory, that is my reading of the definition. But it works. If a solution has no memory between sessions, it is a chatbot with tools attached. No execution — an analytics layer. No autonomous decision-making — a scripted bot with branches. Each of those can be useful, but selling them as an agent is a stretch, and now there is something to point at.

The four basic principles are worth reading literally too: safety and controllability as the floor across the whole development and operation cycle; compliance and orderliness; innovation drive; and pull from applications — with the explicit caveat “simple first, complex later, in sequence.” That last one is rare honesty about pace in a programmatic document.

The core: three categories of decisions

Point six is the one worth keeping the document around for. It requires that an agent’s authority be split into three categories.

• Decisions only the user makes. The agent has no right to perform them under any settings.

• Decisions requiring the user’s authorization. The agent prepares, the human confirms.

• Decisions the agent makes autonomously. Within explicitly granted authority.

And two conditions that matter more than the classification itself. First: the user keeps the right to be informed and to make the final call on the agent’s autonomous actions. Second: the agent’s execution must not go beyond the authorization the user granted.

Three categories of agent decisions under China's Implementation Opinions of May 8, 2026

All of this sounds obvious right up to the moment you try to describe it for a real process in your own company. “Approve a payment up to fifty thousand” — which category is that? What about “send a client an email in the manager’s name”? Or “close a ticket in the system”? The practical value of the document is that it forces you to draw the line explicitly, before deployment rather than after the first incident.

Next to it stands point seven, on behavioural control. It calls for developing built-in rules and behavioural guardrails that keep the agent’s actions lawful in public, private and special spaces. And for important scenarios — exploring blockchain so that agent behaviour is verifiable and traceable.

The foundation: what is required of the technology

The list of common technologies in the second section matches what practitioners call the bottlenecks: task understanding, task planning, tool use, long-term memory, mutual recognition and connectivity between agents, group coordination. Separately — the toolchain: base frameworks, components for perception, memory, decisions, interaction and execution, plus development, testing, deployment and operations tooling.

And alongside them, security tooling: detection of adversarial inputs and anomalous behaviour, and the ability to detect, intervene, block and restore when an agent acts incorrectly.

Those four verbs are a ready-made checklist for any pilot. If your vendor has no answer on all four to the question “what happens when the agent starts doing the wrong thing,” the pilot is premature.

Four requirements for how the system behaves when an agent fails - and a fifth question, about the subject itself

The smart internet and the agent passport

The longest-horizon part of the document, and possibly the most interesting strategically. It calls for exploring a “smart internet” architecture and building an agent registration platform: digital identity management, search and discovery, capability declaration. Plus reference information on the developer, deployment method, interface protocols and compliance certification. For multi-agent interaction — identification, trusted connectivity, compliant payments, protection and conflict resolution.

Put plainly: the agent gets a passport, a registry entry and a declared set of skills, and other agents get a way to find it, verify it and pay it.

If that construct materialises, the point of entry to the customer changes. Today a product competes for a slot in an app store. In this construct it competes to be found and connected by someone else’s agent. The same section pushes an inter-agent interaction protocol as a key national standard — the same protocol later referenced in the Beijing measures.

Risk-tiered management

Point eleven introduces a classification-and-tier management system, based on the application scenario and potential impact.

For sensitive areas and key industries, scenarios are opened by the regulator jointly with sector agencies, and products are subject to registration, testing and recall from the market if problematic.

For low-risk areas — daily life, entertainment, routine office work — there is a lighter regime: compliance self-check tools, information reporting, management through distribution platforms and industry self-regulation.

The logic is the same one Beijing would repeat later: categorisation works not only as a constraint but as an accelerator. Low risk means fast release, high risk means strict review. Mandatory standards are to be developed selectively: medicine, transport, media, public safety.

Two mechanisms complete the picture. First, third-party assessment of functions, performance, quality and compliance, with mutual recognition of certification results, plus regular reporting on the maturity of technologies and applications. Second, a voluntary reputation-rating mechanism for market participants: abuse of technology, pressure selling, false advertising and concealment of defects trigger assessment and subsequent restrictions.

Consumer risks few people write about

Point five stands out from the rest because it talks about the human being rather than the technology. The document explicitly prohibits using data advantage and anthropomorphisation to impose unwanted values or to squeeze the user algorithmically. And it separately requires preventing risks of dependency and emotional attachment among minors and elderly people.

This is worth reading not as somebody else’s regulatory specificity but as an early warning. A personal assistant that accumulates knowledge about a person has, by construction, both the data and the anthropomorphism. The line between a useful tool and a retention mechanism runs not through the technology but through product decisions — what the system does when the user starts coming back to it too often.

Nineteen scenarios: where the state expects results

The fourth section lists typical scenarios across five directions. It is useful not as a task list but as a map of where demand is expected.

Science and industry: full-cycle development assistants, agents wired into design and engineering-calculation systems, automation of the experiment cycle; production scheduling optimisation, machining-accuracy control and defect detection, integration with machine tools and industrial robots; environmental monitoring, power dispatch, transport supervision, agronomic diagnostics; financial risk control — credit decisions, transaction monitoring, anti-money-laundering.

Consumption, welfare and social governance: task execution across apps and devices, round-the-clock customer service, embodied agents in food service, retail and logistics, low-cost care services; generation of learning materials and personalised education paths, medical image analysis and diagnostic reasoning, employment services; assisted processing in public services with a shift from “the person looks for the service” to “the service finds the person,” legal aid, urban planning, procurement support.

What it looks like from the inside: our experience with BAEOS

We are building BAEOS — a personal AI operating system for executives (directors and their deputies) and owners of small and midsize businesses. Points six and seven of this document describe exactly the decisions we had to make ourselves, before the document existed.

Agent rights are set by a matrix. No agent touches the database directly — only through a software layer. Read is the default. Write is possible only with explicit permission and through a draft that a human confirms. Deletion is prohibited entirely. Every call is written to an immutable log. Map that onto the document’s three categories and the match is almost literal: read is the autonomous zone, write is the authorization zone, and anything that changes the company’s commitments is closed to the agent permanently.

The default set of rights we arrived at in BAEOS before the document existed

Tasks are split across several agents, each with its own zone, its own set of accessible data and its own result check. The reason is not architectural aesthetics: the longer the chain of autonomous steps, the lower the chance of reaching the end without an error, and the wider the zone in which nobody catches it.

The model is a replaceable component. No business logic tied to a specific frontier model, and a mandatory isolation layer from the provider. The same requirement reads in the document’s supply-chain security point: managing model connections, interface calls and external tools is a distinct area of responsibility, not an implementation detail.

User resilience is a constraint, not a product goal. Point five, on emotional attachment and algorithmic pressure, is precisely the fork a personal assistant faces at the design stage. The system has a layer that tracks overload and protects the executive’s personal time rather than growing engagement at any cost. Engagement is a bad metric for this kind of product: it conflicts with the job the product is bought to do.

An honest difference: platforms for agent registration, digital identity and mutual certificate recognition are something we do not have and will not get on our own. Everything the document assigns to state infrastructure, a product business will either have to build itself or wait for somebody else to build.

Where the document is strong

1. The definition is given and it works. Five capabilities are a working filter against marketing.

2. Decision authority is split into three categories. The most practical construct in the whole body of Chinese AI documents: you can take it and apply it to your own process in a single working day.

3. The user’s right to the final call is fixed. Not as a declaration but as a limit on execution: the agent does not go beyond the authorization granted.

4. Management is differentiated by risk. The heavy regime is applied selectively, the light one by default. That does not choke experimentation.

5. The four failure requirements are named: detect, intervene, block, restore.

6. Risks to people are covered, not only risks to systems. Dependency, emotional attachment, algorithmic pressure — themes absent from most regulatory documents entirely.

7. Scenarios are listed concretely. Nineteen directions are a map of expected demand, not a list of good intentions.

Weak spots and open questions

1. Who draws the line between categories is not stated. Splitting the authority is mandated, but who decides which category a specific action falls into: the vendor, the customer or the regulator? The answer determines who is liable for a wrong classification.

2. Liability for damage is not allocated. The document describes in detail what the agent must not do, but not who pays when it does it anyway: the agent vendor, the model owner, the customer, or the developer of a connected tool.

3. The registration platform is described as research. Digital identity for agents, capability declaration, mutual recognition — all in “study and build” status, with no deadlines and no named operator.

4. The reputation mechanism is voluntary. Whoever abuses the technology will most likely simply not take part in it.

5. The requirement to align with mainstream values is technically undefinable. For a developer it means moderation whose boundaries are set outside the product and can shift.

6. There is no economics at all. Who pays for what, how to measure effectiveness, and what counts as a completed task — the document does not touch any of it. The Beijing measures would partly close that gap two and a half months later.

7. The assessment indicators are still to be created. A system of agent-development indicators is mentioned in the closing section as a task. Which means there is nothing yet to measure the document’s own results with.

What to do about it as an executive

1. Draw the authority boundary before deployment, not after. Take the process you are about to hand to an agent and sort every action into three categories: human only, with human confirmation, autonomous. It is an hour’s exercise, and it removes most of the arguments you would otherwise have later.

And one clarification, without which the exercise is easy to do as a formality. The agent’s level of autonomy — which “floor” it sits on, from assistant to multi-agent system — and the scope of its authority are two different scales, and they get conflated constantly. The first tells you how many steps the agent takes without a human. The second tells you what it is allowed to decide at all. A company whose agent is “only an assistant” may still have given it the right to change what the company owes a client, and that is more dangerous than a far more autonomous agent in read-only mode. On its own, the level of autonomy says almost nothing about risk: risk is set by authority.

Two axes of risk: level of autonomy and scope of authority

2. Check your vendor against the five-capability definition. Perception, memory, decisions, interaction, execution. Whatever is missing means it is not an agent, whatever the deck calls it.

3. Ask about the four verbs. How the system detects an incorrect action, how it intervenes, how it blocks, and how it restores state. No clear answer on even one of them is a stop for the pilot.

4. Restrict rights by default. Read free, write through human confirmation, deletion never. Plus an action log. This is cheap at the start and almost impossible to retrofit.

5. Start in the low-risk zone. The document’s logic applies without a regulator too: where the error is reversible and visible, the experiment moves fast; where it is not, verify first.

6. Test your own product for engagement. If you are building something that accumulates knowledge about the user, ask yourself the question from point five: does your system help the person come back to it less, or more? The answer determines which side of future regulation you end up on.

7. Watch the agent passports. If registries and capability declarations become the norm, the point of entry to the customer shifts from the app store to somebody else’s agent. Being findable is an architectural decision made in advance.

And the transfer rule. The mechanics do not transfer by outcome. The three categories of decisions, the risk differentiation and the four failure requirements work in any jurisdiction, because they describe properties of the technology. Registries, mandatory standards and reputation mechanisms rest on administrative capacity that another country may not have.

Conclusion

Of the three Chinese AI documents I have covered, this one is the most applicable in practice. The “AI+” plan sets ten-year goals, the Beijing measures describe the economics of agents, and this one answers the question an executive asks first: what will the agent do on its own, and where will it stop and ask.

The answer worth taking away regardless of jurisdiction: the boundary of an agent’s authority is not a technical setting but a management decision. It cannot be delegated to a developer and cannot be deferred until an incident. If you have not drawn that line yourself, your vendor will draw it for you — based on their convenience rather than your risk.

A question for you. Take one process you have already handed to AI, or are about to. Which actions in it does the agent perform entirely on its own — and would you personally sign off on each of them? I would be glad to see your examples in the comments.

Sources: the full text of the Implementation Opinions, the publication notice and the press Q&A on the website of the Cyberspace Administration of China.

This material was prepared with the use of artificial intelligence technologies.