Add ai-decision-authority skill

[kubersharmax]

Adds skills/ai-decision-authority/SKILL.md, a skill for deciding which AI outputs require human approval and which an agent can own outright.

What gap this fills

Teams adopting Copilot and agents hit one of two failure modes. Gate every output and adoption collapses, because using the tool becomes slower than doing the work by hand. Gate nothing and errors accumulate until one does not stay quiet, at which point a blanket review rule gets imposed and you land in the first failure anyway.

Both come from applying a single governance rule to every decision. This skill sorts decisions into three zones by reversibility, exposure, and frequency, and gives each zone a rule plus the cost of misclassifying in either direction.

This is not something a frontier model handles well by default. Asked whether an agent should be allowed to merge a PR or send a customer email, models tend to give a generic "it depends, add human review" answer. The uplift here is a repeatable ordering (reversibility first, because it dominates) and an explicit instruction to gate the boundary inside a workflow rather than the whole workflow at its highest zone, which is where most of the available adoption is lost.

Relationship to existing skills

I checked agent-governance before writing this, and they are complementary rather than overlapping. agent-governance covers technical controls inside an agent: tool allow-lists, intent classification, trust scoring, audit trails. This skill covers the organisational question of who approves what. The SKILL.md cross-references it explicitly and states the division: this one decides what needs a gate, agent-governance implements the gate.

I also checked structured-autonomy-plan, structured-autonomy-implement, and create-architectural-decision-record. Those cover planning and recording decisions, not allocating approval authority over AI output.

On two checklist items

I have left "tested with GitHub Copilot" and "ran npm start and verified README.md is up to date" unticked, because I have not done either and did not want to assert otherwise.

On the first: the skill is instructions only, with no scripts or assets. I validated the zone boundaries by walking a mixed set of decisions through the three questions, including the split case where drafting and publishing in one workflow separate across two zones. I have not run it inside a Copilot session end to end. Say the word if that is a hard requirement and I will do it and report back.

On the second: recent merged skill PRs in this repo touch only skills/<name>/, so I assumed the tables are generated by the build rather than committed by contributors. Happy to run it and push the result.

Notes

Single file, no bundled assets, no external dependencies, no paid services. I did not regenerate the docs tables, since recent merged skill PRs touch only skills/<name>/ and the tables appear to be generated by the build. Happy to run npm run build and push the result if you would like it in the PR.

The zone model is adapted from published practitioner work across 16 product launches in one enterprise function. Specific percentages from that deployment are deliberately omitted, because the boundaries generalise and the distribution does not. Provenance is stated at the bottom of the SKILL.md.

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Additional Notes

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🔒 PR Risk Scan Results

Scanned 1 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	0

✅ No matching risk patterns were detected in changed files.

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🔍 Vally Lint Results

✅ All checks passed

Scope	Checked
Skills	1
Agents	0
Total	1

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	0

Summary

Level	Finding
ℹ️	✅ ai-decision-authority (2/2 checks passed)
ℹ️	✓ [spec-compliance] All 1 skill(s) are spec-compliant.
ℹ️	✓ spec-compliance: All spec checks passed.
ℹ️	✓ [valid-refs] All file references across 1 skill(s) are valid.
ℹ️	✓ valid-refs: All file references resolve to existing files within the skill directory.
ℹ️	1 skill(s) linted, 1 passed

Full linter output

### Linting skills/ai-decision-authority
✅ ai-decision-authority (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

[aaronpowell]

If it hasn't been tested with Copilot then I have minimal faith that it's bringing any value.