Write the people data decision rights register before agents act
Deloitte's 2026 trends report puts decision rights and trust in data at the center of the year, yet most HR teams still have no written record of which workforce calls an AI agent may make alone.
Most people analytics teams can produce an attrition model faster than they can answer a simpler question: who authorized the model to act? That is the people data decision rights gap heading into 2026. The dashboards exist, the data dictionary exists, and in a growing number of HCM platforms the AI agents exist too. What almost nobody has written down is which workforce decisions an agent may execute alone, and whose name is on the file when the output turns out to be wrong.
Why 2026 turned decision rights into the people analytics question
Deloitte's 2026 Global Human Capital Trends reframes the year around culture, decision rights and trust in data itself. The report does not present the authority question as settled. It asks explicitly who has the right to decide when algorithms act and when humans intervene, and treats protection against misinformation and untrustworthy AI outputs as an organizational design problem rather than a vendor feature.
The pressure is arriving from the technology side at the same time. ADP's HR technology outlook, updated in August 2026, describes agentic AI as a core component of HCM systems now generating workforce insights, with data quality, interoperability, security and governance as the gating factors rather than model performance. S&P Global Market Intelligence named people analytics, employee experience and talent intelligence as primary HR tech market growth drivers in February 2026, which in practice means more agent-generated people data arriving faster than most governance processes were designed to absorb.
The scale of the shift inside HR itself is not marginal. The Josh Bersin Company identified more than 100 potential HR agents across employee services, recruiting, performance and workforce management in January 2026, projecting up to 30% fewer HR staff as agents move from assistant to workflow automation, and estimating that 30% to 40% of existing HR work can be automated. Korn Ferry data cited in 2026 talent trend roundups indicates more than half of talent leaders plan to add autonomous AI agents to their teams this year.
A statement that the organization keeps humans in the loop is not auditable. A register that names which human, for which decision, is.
Why HCM systems do not produce an accountability trail on their own
Bersin's diagnosis is useful here because it explains a structural problem rather than a behavioral one. Legacy HCM platforms were built as workflow and record-keeping systems, not decision systems. They log that a field changed and who changed it. They were never designed to log that an inference was made, on what data, under whose authority, and with what confidence.
That is why agent outputs tend to arrive clean and context-free. A flight-risk score appears in a manager's view with no record of which model version produced it, whether the underlying tenure data reconciled with the system of record, or who signed off on using it in a retention conversation. The number looks like a fact. Six months later, in a grievance process or a pay equity review, nobody can reconstruct the chain.
Governance documents that stop at principles do not close this. A statement that the organization uses AI responsibly and keeps humans in the loop is not auditable. What is auditable is a use-case-level record that says this specific decision, on this specific data, sits at this specific level of authority, and this named role owns the outcome.
The four-tier people data decision rights register
The artifact is deliberately small. One page, four tiers, one row per analytics use case. Tier one is agent acts: the agent executes without human review, appropriate only for low-stakes, reversible, non-individualized tasks such as refreshing a headcount dashboard or flagging a data quality break in a feed. Tier two is agent recommends: the agent produces an output that routes to a named human who can accept or reject it, with the rejection logged. Tier three is human decides: the agent may assemble evidence but the decision is made by a person, with the agent output treated as one input among several. Tier four is human plus legal review: the decision touches protected characteristics, pay, discipline or exit, and requires sign-off beyond the people function.
Map the common use cases against those tiers and the conversation becomes concrete quickly. Attrition risk flags surfaced to a manager are usually tier two at most, because an unexplained flag can shape performance treatment. Headcount forecasts feeding a planning cycle are often tier two or three depending on whether they trigger hiring freezes. Compensation modeling belongs in tier three or four. AI-generated performance summaries used in calibration should sit no lower than tier three, and tier four where they influence termination decisions.
Three columns matter as much as the tier itself. First, the escalation path when an agent output conflicts with the system of record, because that conflict will happen and the default today is that whoever notices it quietly picks one. Second, the named accountable role, a person or position rather than a team. Third, the evidence retained, meaning what an auditor or plaintiff's counsel would be shown if asked to explain the decision two years later.
Building the register without stalling the analytics roadmap
The failure mode is a six-month governance project that produces a policy nobody reads. Avoid it by starting with the use cases already live. List every place an agent or model output currently reaches a manager, a candidate or an employee. In most organizations that list is between eight and twenty items, which is a workshop, not a program.
Assign tiers in the room with HR, legal, data and one operating leader present. Disagreement about tiering is the point of the exercise, because it surfaces where the organization has been operating on assumed authority. When a talent acquisition lead believes an agent may auto-reject applications and legal believes it may only rank them, that gap was already there. The register just makes it visible before a regulator does.
Then set a review cadence tied to change, not to the calendar. A new model version, a new data source, a new jurisdiction or a vendor upgrade that enables autonomous action should each trigger a re-tiering check. i4cp's 2026 priorities for people analytics leaders and Gartner's refreshed 2026 CHRO priorities both keep analytics credibility near the top of the agenda. Credibility is easier to defend when the authority behind each number is documented before the number is challenged.
