If you are building an agent that will ever touch a user in China, one requirement now sits ahead of your roadmap: before you deploy, you have to sort everything your agent can do into three tiers of decision authority — and prove a human sits at the right level of each one.
That is the operative core of the Implementation Opinions on the Standardized Application and Innovative Development of Intelligent Agents, issued jointly by the Cyberspace Administration of China (CAC), the National Development and Reform Commission (NDRC), and the Ministry of Industry and Information Technology (MIIT). It was released on May 8, 2026 and took effect on July 15. It is being read as the first national framework written specifically for AI agents — systems that perceive, remember, decide, interact, and execute — as opposed to the model- and chatbot-era rules that came before it.
Here is the whole thing in one screen, then the part that actually changes your architecture.
The three tiers, in plain terms#
Every action your agent can take has to be classified by its consequence, and the classification decides who is allowed to pull the trigger:
- Human-only — decisions reserved for a person. The agent can propose; it may never execute these on its own, no matter how confident it is or how much the user opts in.
- Approval-required — the agent may take the action, but only after the user approves that specific action first. A pause, a prompt, an explicit yes.
- Autonomous — low-consequence actions the agent completes on its own, with a log the user can inspect afterward.
The higher the stakes, the higher the tier, and the framework requires the human-approval threshold to scale with the consequence. Underneath the tiers sit two principles that apply across all three: the user keeps the right to know what the agent is doing and the final say over it, and the agent may not act beyond the scope it was authorized for.
The tiers aren't the hard part. The hard part is that "approval-required" is a per-action gate, not a settings toggle — your agent has to know which of its own actions cross the line, and stop itself at exactly those.
The middle tier is the design change#
Read the three tiers as an engineer and the top and bottom are easy. "Human-only" is a block — you already have actions your product refuses to automate. "Autonomous" is your happy path plus a log, which any observable agent already writes.
The approval-required tier is where the work is. It is not a global "ask me first" preference. It is a gate that fires on specific actions once their consequence crosses a threshold: the agent has to pause mid-run, surface what it is about to do and what is at stake, and wait for a human decision before it continues — then carry that decision back into its loop. That means three capabilities most fully-autonomous agents don't have yet:
- Action classification. The agent — or the framework around it — has to tag each action it can take with a consequence level, so the gate knows when to fire. This is the same muscle as a permissions model, applied to effects rather than resources.
- A checkpoint it can stop at. The loop needs a real suspend-and-resume: hold state, ask, wait, continue. Agents built around a human-in-the-loop confirmation step already have this; a straight-through executor does not.
- Scope binding and an override. The user's authorization defines a boundary the agent can't cross, and the user needs a way to intervene — before an autonomous action and after it.
If your agent already logs every action and can pause for confirmation on the risky ones, you are most of the way to compliant by construction. If it runs straight through, this is the architecture note to act on. (For the mechanics of the gate itself, our walkthrough on requiring human sign-off before your agent acts is the how-to; the tiers just tell you which actions have to route through it.)
What sensitive sectors add#
If your agent operates in healthcare, transportation, media, or public safety, the tiers are the floor, not the ceiling. Those sectors carry mandatory regulatory filing, compliance testing, and product-recall provisions on top. If you are building for one of these verticals in the Chinese market, budget for a filing-and-testing cycle with a regulator — that is a process and a timeline, not a code change you ship on a Friday.
What a founder does with this#
You do not need a China legal team to take the useful thing from this. The three-tier split is a good default for any agent that acts on a user's behalf, and it is cheap to adopt now:
- Inventory your agent's actions and tag each by consequence. Most fall cleanly into "always fine to do alone," "should ask first," and "never without a human." That inventory is your tier map.
- Build the middle gate once. A per-action confirmation checkpoint, keyed to a risk threshold you set, is reusable across every action that needs it — and it is the single capability the framework leans on hardest.
- Log everything and give the user an override. The right to know and the final say are satisfied by an inspectable action log plus a kill switch. Both are things you want anyway.
China moving first here is the signal worth reading. The persona and companion rules earlier this month governed how an AI is allowed to present itself; this one governs how much it is allowed to decide. It is the first regulation to treat "how autonomous is this agent, on which action" as the unit of governance — which is exactly the question your own users, and eventually your other regulators, are going to ask. Building the three-tier gate now is compliance in one market and good product everywhere. For the wider governance map this fits into, see our read on the WAICO vs Pax Silica split and China's earlier move to make agent interconnection a national standard.
