Agencies need clear policies around access, approvals, data handling, execution, and verification before greater autonomy is introduced.
