The AI Decision Rights Matrix for Complex Projects
AI can now draft a contract clause, flag a procurement anomaly, summarize a HAZOP action log, forecast cost at completion, and propose schedule recovery options in seconds. That does not mean it should be allowed to approve a variation, release a purchase order, accept a safety risk, or instruct a contractor.
That distinction matters in complex capital projects. Oil and gas, EPC, construction, energy, mining, utilities, marine, and infrastructure organizations operate in environments where decisions carry safety, legal, commercial, regulatory, and public consequences. A wrong answer may not just create rework. It may breach a contract, compromise a design basis, expose confidential data, mislead stakeholders, or place people at risk.
Most project organizations are no longer asking whether AI can help. The harder question is what AI is authorized to decide.
An AI Decision Rights Matrix gives project teams a practical way to answer that question. It defines where AI may inform, recommend, draft, execute within agreed limits, or defer entirely to a human decision-maker. Done well, it moves AI governance away from vague approval slogans and toward a clear operating model based on consequence, reversibility, authority, data sensitivity, contractual exposure, and safety significance.
Why One Approval Rule Does Not Work For AI
Many organizations start with a simple rule: AI outputs must be reviewed by a person. That sounds sensible, but it is too blunt for project delivery.
A chatbot summary of daily progress data does not need the same control as an AI-generated recommendation to accept a contractor’s delay claim. An automated reminder to update a risk register does not carry the same risk as an AI-triggered procurement release. A draft stakeholder update is not the same as a regulatory submission.
Project governance already recognizes different levels of authority. Delegations of authority, procurement thresholds, technical assurance gates, management of change procedures, HSE permit systems, and contract administration protocols all separate low-risk work from high-consequence decisions. AI governance should follow the same logic.
Credible governance frameworks point in this direction. PMI and APM both emphasize governance, accountability, defined roles, and decision-making discipline in project environments. ISO 31000 frames risk management around context, assessment, treatment, monitoring, and communication. ISO/IEC 23894 addresses AI-related risk management, while ISO/IEC 42001 provides a management system approach for AI. NIST’s AI Risk Management Framework focuses on mapping, measuring, managing, and governing AI risks. AACE International’s recommended practices reinforce the need for traceable estimates, forecasts, change control, and project controls governance.
None of these sources support the idea that technology capability alone should determine authority. They point to a more mature view: decision rights must match risk.
A practical AI governance model should assess each use case against at least six factors.
Consequence
What happens if the AI is wrong, incomplete, biased, outdated, or misunderstood? Some errors create inconvenience. Others create injury, claims, regulatory exposure, or major cost impact.
Reversibility
Can the decision be undone at low cost? A draft report can be corrected. A released purchase order, approved design change, or executed work package may be difficult or expensive to reverse.
Authority
Who has formal authority under the project charter, contract, delegation of authority, engineering assurance plan, or regulatory framework? AI cannot inherit authority simply because it can generate an answer.
Data sensitivity
Does the task involve personal data, confidential pricing, privileged legal advice, export-controlled information, commercially sensitive bids, or security-related asset data?
Contractual exposure
Could the output amend obligations, waive rights, certify completion, approve payment, accept liability, or create reliance by another party?
Safety significance
Could the decision affect process safety, construction safety, lifting operations, energization, isolation, commissioning, environmental controls, marine operations, or asset integrity?
These factors produce a more useful governance question than “Can AI do this?” The better question is “What level of decision right is appropriate for this task, in this context, with these controls?”
The AI Decision Rights Matrix
The AI Decision Rights Matrix below is a starting point. It can be adapted to a company’s existing governance framework, project size, contract model, digital maturity, and regulatory environment.
Decision category | What AI may do | What AI may not do | Typical controls | Project examples |
Inform | Provide information, analysis, summaries, comparisons, anomaly flags, or data visualization | Select the course of action or initiate a project action | Source traceability, data quality checks, user training, output labeling, audit logs | Summarize progress reports, compare planned versus actual quantities, flag missing inspection records, identify schedule logic gaps |
Recommend | Propose options, rank alternatives, identify risks, or suggest next steps | Approve the recommendation or commit the project | Human decision record, confidence thresholds, model validation, peer review for high-risk cases | Suggest schedule recovery options, rank procurement bids against stated criteria, propose risk responses, forecast cost at completion |
Draft | Prepare text, forms, registers, notices, minutes, commercial narratives, or technical summaries for review | Issue formal communications, approve contractual content, or represent the organization’s position without human approval | Mandatory review, version control, legal or technical sign-off, prompt and output retention | Draft contract correspondence, prepare claim chronology, write stakeholder updates, create draft commissioning checklists |
Execute within limits | Take predefined actions within approved thresholds, rules, permissions, and rollback paths | Act outside thresholds, override controls, approve exceptions, or make judgment-based commitments | Delegated limits, access controls, automated logs, escalation triggers, rollback provisions, periodic permission review | Send reminders, route approvals, update dashboards, reorder consumables below a threshold, assign routine document reviews |
Human-only decision | Support analysis, present evidence, or simulate scenarios | Approve, initiate, certify, commit, waive, reject, or direct the final action | Named accountable decision-maker, formal approval workflow, independent review, management of change, legal or HSE assurance | Approve major variations, accept safety-critical risk, certify completion, approve claims settlement, change design basis, discipline personnel |
The matrix should not sit in a policy document that nobody uses. It should be embedded in the tools and workflows where decisions occur: procurement systems, document control platforms, project controls dashboards, contract management systems, engineering review workflows, commissioning systems, and HSE platforms.
The matrix also needs ownership. A project controls manager may own AI forecasting rules. Legal may own contract drafting and privilege controls. HSE may own AI use in safety observations and permit workflows. Engineering authority may own technical decision boundaries. The project director or sponsor should own the overall allocation of decision rights, since the combined risk sits at project level.
How The Matrix Applies Across Project Functions
The value of the AI Decision Rights Matrix for Complex Projects becomes clear when it is tested against real project work. Most use cases are not purely technical or administrative. They sit at the intersection of cost, contract, schedule, safety, and stakeholder confidence.
Procurement And Supply Chain
AI can help procurement teams compare bids, detect missing documents, identify pricing anomalies, summarize vendor qualifications, and flag possible conflicts between a requisition and project specifications.
Many of these uses fit the inform or recommend categories. AI may help rank options against pre-approved criteria, but the buyer, package manager, technical authority, and commercial approver must retain decision rights.
AI may execute within limits for low-risk actions, such as routing a bid clarification to the correct reviewer, notifying vendors of missing standard forms, or reordering approved consumables below a defined value. The organization should set clear limits by value, commodity type, vendor status, contract framework, and technical criticality.
Stronger human control is required when procurement decisions involve:
Awarding a contract or purchase order
Accepting commercial deviations
Changing delivery terms or liquidated damages
Approving single-source procurement
Selecting safety-critical equipment
Releasing advance payments
Managing sanctions, export control, or local content obligations
AI can support the file. It should not become the contracting authority.
Contract Review And Claims
Generative AI is useful for summarizing contract clauses, comparing drafts, extracting notice periods, building chronologies, and identifying inconsistencies across correspondence. Legal commentary on AI use often stresses accountability, confidentiality, privilege, and the risk of relying on plausible but incorrect outputs. Those concerns are especially relevant in disputes and claims.
Most contract use cases belong in inform, draft, or recommend. AI can draft a notice of delay, prepare a claim chronology, or compare entitlement arguments against contract language. A qualified person must decide whether to issue the notice, assert entitlement, waive a right, settle a claim, or admit liability.
Human-only decisions should include:
Issuing formal claims or notices with legal effect
Approving settlement positions
Waiving contractual rights
Accepting liability
Certifying completion or non-completion
Terminating or suspending work
Making representations to regulators, lenders, insurers, or government entities
For these tasks, AI controls should include restricted access, secure environments, record retention, legal review, and clear separation between draft support and formal approval. If privileged or confidential material is involved, the organization should treat tool selection and data handling as governance decisions, not IT preferences.
Cost Forecasting And Project Controls
AI can add real value in cost and schedule control. It can detect trends, identify outliers, test forecast assumptions, compare productivity curves, and generate early warnings from large datasets. AACE International practices emphasize disciplined estimating, cost control, change management, and traceability. AI should reinforce that discipline rather than replace it.
AI may inform by showing variance patterns, commitment burn rates, earned value signals, productivity shifts, or contingency drawdown. It may recommend forecast ranges or highlight packages that need reforecasting.
Approving the forecast remains a human responsibility. The cost manager, project controls manager, project manager, and sponsor need to understand assumptions, exclusions, data quality, and commercial context. A model might identify a trend before the team sees it, but it cannot know whether a pending variation will be approved, whether a supplier claim is commercially defensible, or whether management intends to resequence work.
Higher control is needed when AI affects:
Estimate at completion
Contingency release
Management reserve use
Project funding requests
Impairment signals or financial reporting
Contractor payment recommendations
Performance reporting to joint venture partners or boards
Useful controls include forecast approval workflows, change logs, documented assumptions, independent review for major movements, and thresholds that force escalation.
Scheduling And Execution Planning
AI can analyze schedule logic, identify missing links, detect negative float drivers, suggest resequencing, simulate weather or access constraints, and propose recovery options. These are strong inform and recommend use cases.
AI may help a planner see that a critical path has shifted. It may recommend a crew sequence or temporary workaround. It should not independently approve a recovery plan that changes work fronts, increases simultaneous operations, or compresses safety checks.
Scheduling decisions become high-control when they affect:
Shutdown windows
Marine operations
Heavy lifts
Energization and isolation
Work at height or confined space activities
Interface with live plant
Regulatory inspection dates
Third-party access or community disruption
The common failure mode is subtle. AI does not “decide” formally, but its recommendation becomes the plan because nobody challenges it. Research on automation bias has long warned that people may over-trust automated outputs, especially under time pressure or when systems appear authoritative. Projects are full of time pressure. That makes review quality as important as review existence.
Safety And HSE
AI can support HSE teams by classifying observations, detecting recurring hazards, summarizing incident reports, identifying overdue actions, and analyzing leading indicators. It may also support computer vision, permit checks, or environmental monitoring where laws and site rules allow.
Still, safety significance changes the decision rights. AI may inform and recommend. It may execute within limits for low-consequence actions, such as sending reminders for overdue corrective actions or blocking submission of incomplete digital permit fields.
Human-only decisions should include:
Accepting a safety risk
Approving a permit for high-risk work
Authorizing confined space entry, critical lifts, hot work in sensitive areas, or energization
Closing major incident actions
Changing safety-critical procedures
Determining disciplinary outcomes after incidents
Restarting work after a serious event
Professional engineering institutions and safety regulators consistently place responsibility on competent, accountable people. AI may support competence. It cannot replace duty holder accountability or responsible charge.
Technical And Engineering Decisions
AI can summarize standards, compare design options, identify constructability issues, review calculations for anomalies, and draft technical queries. These uses can save time, especially on large programs with thousands of documents.
Yet engineering decision rights must reflect design authority. AI should not approve a design basis change, accept a nonconformance, override a code requirement, or release safety-critical calculations. Irreversible design choices need stronger review because the cost of correction rises sharply once procurement, fabrication, installation, or commissioning begins.
AI-related controls for engineering should include:
Clear model and data boundaries
Verification against approved codes, specifications, and project requirements
Registered or chartered professional review where required
Interdisciplinary checks
Management of change integration
Documented acceptance of deviations
An AI-generated answer that cites a standard incorrectly is not a minor issue if it influences pressure containment, structural stability, fire protection, electrical safety, or environmental compliance.
Stakeholder Communications And Regulatory Obligations
AI is well suited to drafting stakeholder updates, summarizing consultation feedback, translating routine notices, and preparing first drafts of reports. These tasks often sit in the draft category.
The final communication can carry major consequences. A poorly worded community update may damage trust. A regulatory filing may create legal exposure. A lender report may influence funding decisions. A public statement may affect market confidence.
Human control should increase when communications involve:
Regulators or government authorities
Local communities affected by land, access, noise, traffic, or environmental impacts
Indigenous or traditional land stakeholders where relevant
Joint venture partners
Lenders, insurers, or auditors
Media or public disclosure
Crisis response
AI may draft the message. Accountable leaders must approve the position.
Commissioning And Handover
Commissioning is rich with AI use cases: checklist completeness, punch list grouping, turnover package status, test record review, spares readiness, and anomaly detection across systems.
Some execution within limits may be appropriate. AI can route incomplete turnover dossiers, send reminders, or flag missing certificates. It may not authorize energization, introduce hydrocarbons, approve start-up, accept incomplete safety systems, or certify readiness for operation.
Commissioning decisions often have low reversibility and high safety significance. That places them near the human-only end of the matrix. The more a decision affects live energy, pressure, chemicals, rotating equipment, marine systems, or environmental discharge, the more explicit human authority must be.
Controls That Make Decision Rights Real
A matrix without controls is only a diagram. To make AI decision rights work, organizations need technical, procedural, and behavioral controls.
Authority thresholds
Set limits by value, risk rating, discipline, contract type, and asset criticality. For example, AI may route purchase requisitions below a defined value but cannot approve them. It may recommend contingency adjustments below a threshold but must escalate larger changes.
Human-in-the-loop approval
Human review should be meaningful. The approver needs access to source data, assumptions, model output, confidence level where available, and the reason for the recommendation. A click-through approval is not governance.
Audit trails
Every significant AI-assisted decision should leave a record: input data, model or tool used, output, reviewer, approval, time, and any changes made. This matters for claims, audits, regulatory inquiries, lessons learned, and internal assurance.
Escalation rules
AI systems should escalate when outputs cross risk thresholds, conflict with approved baselines, detect missing data, or identify low confidence. Escalation should go to a named role, not a generic mailbox.
Validation requirements
Models used for forecasting, risk scoring, technical review, or safety analysis need validation before use and periodic checks after deployment. Validation should test accuracy, bias, drift, data quality, and alignment with project procedures.
Access controls
Not every user should access every AI capability. Contract, HR, legal, bid, engineering, and HSE datasets require different controls. Permissions should reflect role, need to know, project phase, and confidentiality.
Confidence thresholds
Where a tool provides confidence indicators, set rules for action. Low-confidence outputs may be used to prompt review, not to recommend a decision. High confidence should not remove approval where consequence is high.
Rollback provisions
If AI can execute within limits, the team needs a way to reverse the action. This is practical for reminders, workflow routing, and dashboard updates. It is much harder for contract commitments, safety approvals, or procurement releases, which is why those decisions need stronger human control.
Periodic review of AI permissions
Decision rights should change as the project changes. A tool approved for early estimating may not be suitable for claims. A model trained on design-phase data may drift during construction. Permissions should be reviewed at phase gates, after incidents, after major contract changes, and when tools or datasets change.
Technical Capability Is Not The Same As Decision Authority
A recurring mistake in AI adoption is the belief that autonomy should increase as soon as the tool performs well.
That logic is flawed. A junior engineer may be technically capable of drafting a calculation, but the organization still requires checking and approval. A planner may produce a recovery schedule, but the project manager must approve changes that affect cost, safety, and contractual milestones. A contracts administrator may prepare a notice, but legal and commercial leadership may need to approve issuance.
AI should be treated with the same discipline, plus extra controls for opacity, data risk, automation bias, model drift, and scale. An AI tool can produce thousands of outputs quickly. If the decision boundary is unclear, the organization can scale errors as easily as it scales productivity.
The right question is not whether AI can produce an acceptable result. The right question is whether the organization is willing to assign it authority for that class of decision under known conditions.
For complex projects, the answer will vary. AI may act autonomously within narrow, reversible, low-consequence rules. It may recommend in moderate-risk areas. It may draft content where human review is mandatory. It should defer completely where legal commitment, safety-critical work, major expenditure, irreversible design choices, regulatory obligations, personnel decisions, or significant stakeholder consequences are involved.
Warning Signs That AI Governance Is Weak
Weak governance often appears before a major failure. The signals are visible if leaders know what to look for.
Common leading indicators include:
Unclear ownership of AI tools and outputs
Automated actions without traceable approval
Teams relying on AI recommendations without challenge
No record of prompts, source data, assumptions, or model versions
Undefined boundaries between advice, recommendation, approval, and action
Different departments applying different review standards to similar risks
AI tools connected to sensitive datasets without documented access rules
Contract or legal drafts issued with minimal review because they “look standard”
Forecasts changing without a clear explanation of drivers
Safety observations classified or closed without competent review
Project teams unable to explain how an AI-enabled decision was reached
Tool permissions remaining unchanged after the project moves into a higher-risk phase
These signs do not always mean the AI tool is poor. They often mean the surrounding management system is immature.
Questions Leaders Should Ask Before Assigning Ai Decision Rights
Project directors, sponsors, commercial managers, HSE leaders, legal teams, and senior executives do not need to become data scientists. They do need to ask sharper governance questions.
Before assigning decision rights to an AI system, ask:
What decision is being made, and what is the difference between informing, recommending, drafting, executing, and approving?
Who owns the decision under the contract, delegation of authority, procedure, or regulation?
What is the worst credible consequence if the AI output is wrong or misused?
Can the action be reversed, and at what cost?
Does the task involve confidential, personal, privileged, export-controlled, or commercially sensitive data?
Could the output create contractual reliance, waive rights, approve payment, or admit liability?
Could the decision affect safety, environmental performance, asset integrity, or regulatory compliance?
What evidence will the human approver review?
What audit trail will exist after the decision?
What confidence level, data quality, or validation evidence is required?
When must the system escalate to a human?
Who can override the AI, and how is that override recorded?
How often will permissions be reviewed?
What training do users need to understand the limits of the tool?
What happens if the AI system is unavailable, compromised, or found to be unreliable?
These questions help turn AI governance from an abstract policy into a practical decision architecture.
They also help senior leaders avoid two opposite errors. One error is blocking useful AI because governance feels too difficult. The other is allowing AI to influence high-consequence decisions without clear authority. Mature organizations will avoid both. They will use AI heavily, but with decision rights that reflect risk.
A Practical Way To Implement The Matrix
The best starting point is not a long policy. It is a use-case inventory.
List the AI-enabled tasks already in use or planned across the project. Include unofficial tools, spreadsheets with AI add-ins, document review tools, contract analysis platforms, scheduling assistants, forecasting models, HSE analytics, and reporting tools.
For each use case, assign:
Business owner
Decision category
Data types used
Maximum authority level
Required human approver
Approval threshold
Validation requirement
Audit trail requirement
Escalation trigger
Review date
Then test the classification against real scenarios. If AI drafts a contract notice, who approves it? If AI recommends a forecast increase, who signs off? If AI flags a critical safety trend, who must respond? If AI updates a risk score, does that change contingency, reporting, or executive escalation?
This exercise often exposes gaps in ordinary governance as much as AI governance. That is useful. AI has a habit of revealing unclear accountability that already existed.
The matrix should then be built into project procedures and systems. Procurement workflows can prevent AI-assisted purchase recommendations from becoming approvals. Contract systems can label AI-drafted text and require review. Project controls tools can record AI-generated forecast assumptions. HSE systems can stop automated closure of serious actions. Engineering platforms can require accountable technical approval for AI-supported outputs.
Training should focus less on generic AI awareness and more on decision behavior. People need to know when they are using AI as a calculator, an analyst, a drafter, a recommender, or an automation engine. They also need to know when they are the accountable decision-maker and cannot outsource judgment to a machine.
The Professional Takeaway
AI will become normal in complex project delivery. It will support faster analysis, better pattern detection, stronger documentation, and earlier warnings. Used well, it can improve project control and decision quality.
But autonomy should not expand just because the technology can perform the task. Complex projects depend on accountable authority, especially where decisions affect safety, contracts, cost, design, regulation, people, and stakeholders.
The enduring governance test is simple: define not only what AI can do, but what it is actually authorized to do.
