Five outcomes
Allow and deny are not enough
A control that can only permit or block forces every borderline case into one of two wrong answers. And borderline is where all the interesting decisions live.
A small example that breaks a binary
A sales agent proposes a 22% discount. Your team guideline is 15%. Your hard limit is 25%.
With two options, you're stuck. Block it, and the agent can't do something it's actually allowed to do, so people start routing around the control. Allow it, and nobody ever finds out that the guideline is being blown past on a regular basis.
Both answers are wrong, and the situation isn't unusual. Most real policies have a permitted range, a preferred range, and a line where somebody should take a look. A control that can't say that will end up either annoying or blind.
This turns out to be more than an inconvenience. Gartner named it directly in 2026: enterprises are treating agent governance as binary, either locked down or fully trusted, and that is the root cause of failure. Its forecast is that by 2027, 40% of enterprises will demote or decommission autonomous AI agents because of governance gaps found only after production incidents.
Five answers instead of two
Allow. Inside policy. Nothing to do except record that the check happened and what it found.
Warn. Allowed, but outside the preferred range. Work continues and the exception goes on the record for someone to look at later. This is the one that keeps a policy honest, because it shows you drift without stopping anybody.
Transform. What was proposed isn't allowed, but something close to it is. Cap the amount, redact the field, swap the recipient. Keep moving, and keep the correction on the record.
Escalate. Beyond what the system should be deciding alone. The workflow holds while an authorized reviewer decides, and their answer comes back into the workflow instead of dying in a ticket.
Deny. Not allowed, nothing to substitute. The action doesn't happen and the reason stays attached.
The two everyone leaves out
Allow, Deny, and Escalate are easy to argue for. The two that go missing are the middle ones, and they carry more weight than they look like they should.
Gartner's recommendation is tiered governance, proportional to what each agent actually does, and their diagnosis of why organizations fail at it is worth repeating: they don't distinguish between an agent's ability to act and the scope of access it's been granted. Warn and Transform are where that distinction lives. They're how a control says "you may do this, within these bounds, and here's the record" instead of picking one of two extremes.
Warn keeps a policy connected to reality. If exceptions are invisible until they turn into incidents, then the first time you learn your guideline no longer matches the business is an escalation that surprises everyone. Flagging makes the drift visible while it's still cheap to fix.
Transform keeps a control from becoming the thing people work around. A lot of what a binary control blocks isn't genuinely forbidden. It's fine except for one field. Handing back a corrected version keeps the work moving and puts the correction in the record where an auditor can see it.
Who applies the answer
Worth being clear about this, because it decides where responsibility sits.
The policy check returns an outcome. Your application applies it. We don't reach into your workflow and stop the payment. We tell your application what policy says while it can still do something about it, and we record what your application reports back.
That line matters twice over. Your application stays in charge of its own execution, which is what makes this a connection rather than a rebuild. And the record ends up holding both halves: what policy decided, and what the system actually did. Those two can differ. When they do, that's precisely what an investigation needs to see.
Try the five answers on a real scenario
Change the facts of a workflow and watch which outcome comes back, and why.