Your organization requires that every AI agent's autonomy level (and the permissions granted to support it) be formally documented with a rationale that can be audited during a compliance review. Where and how should this documentation be created?
Select an answer to reveal the explanation.
Short Explanation and Infographic
An ADR is a formalized decision audit trail — it records not just what was decided (the autonomy tier) but why, what alternatives were considered, what risks were accepted, and what controls offset those risks. It is the compliance auditor's first stop when reviewing agent governance.
Full explanation below image
Full Explanation
Architecture Decision Records (ADRs) are the industry-standard format for documenting architectural and governance decisions in a way that is versioned, reviewable, and auditable. For agent autonomy assignments, an ADR should contain: (1) the decision (autonomy tier X with permissions Y), (2) the context (what the agent does, why that autonomy level is needed), (3) the alternatives considered (lower and higher autonomy tiers and why they were rejected), (4) the consequences (risks introduced and compensating controls implemented — required status checks, CODEOWNERS rules, environment protection rules, etc.).
ADRs are typically stored in the repository as .adr/ or docs/decisions/ files, making them version-controlled, linkable, and accessible to compliance reviewers without needing access to email or verbal accounts.
Option A (README.md) is documentation but not at the right level of formality or structure for compliance review. READMEs are frequently updated and not designed to capture point-in-time decisions with rationale.
Option C (YAML comment) provides proximity to the configuration but is limited to a comment field with no structured format, no alternatives discussion, no risk register, and no formal approval record. Comments are implementation notes, not decision records.
Option D (email to security team) is not version-controlled, not discoverable without email search, cannot be formally approved with a review mechanism, and does not constitute a formal record in most compliance frameworks.
ADRs stored in the repository provide the auditable, structured, version-controlled record that compliance frameworks require for agent governance decisions.