Decide What Runs Without You

Vocabulary for this episode

Coined here: Autonomy Ladder (the artifact). Work class (the unit autonomy attaches to — never the agent). Promotion evidence standard. Standing demotion trigger. The oversight paradox (a gate that degrades precisely as the system it oversees improves). The capacity exception. Autonomy debt. Reversal authority as a grant distinct from action authority.

What you own

This episode has the least ambiguous ownership in the series and the most frequent misassignment.

There is a precedent for this division that predates agents. In Google's SRE practice, Product Management defines the SLO — the expectation of how much the service should deliver — while a neutral monitoring system measures actual performance, and the difference between the two is the error budget8. The reliability target is a product decision. The measurement is not.

Episode 06 applies the same split to autonomy. Engineering can remove a gate in an afternoon. Only product can say what the organization is agreeing to when it does.

Queue pressure is an operations problem. It is never, by itself, evidence of readiness. Conflating them is the most common way autonomy expands without justification.

Where this sits in the series

EPISODE 01  Bounds what one run may cause          Consequence Envelope
EPISODE 02  Defines the world it reasons in        Environment Manifest
EPISODE 03  Establishes whose authority it carries Authority Matrix
EPISODE 04  States what survives compromise        Containment Model
EPISODE 05  Proves whether all four still hold     Operating Contract
        |
EPISODE 06 — THIS ONE                              Autonomy Ladder
Decides which human gates the accumulated
evidence has earned the right to remove
        |
EPISODE 07  How that evidence gets produced safely Fidelity Plan
EPISODE 08  Whether the whole thing ships          Readiness Gate

Episodes 01–04 built constraints. Episode 05 built the evidence system. Episode 06 is the first episode that spends what the previous five earned — and the only one that can put it back.

Two couplings are load-bearing and are developed below rather than asserted here. Every promotion resets the baseline in Episode 05's contract, because a promoted work class is a new cohort with a new distribution that must re-earn its evidence at the new rung. And every rung is enforced somewhere — a fact Episode 03 already established for authority and which applies unchanged to autonomy.

01Autonomy is granted to work, not to agents

The first correction, and it invalidates most autonomy conversations before they start.

"Should the refund agent be autonomous?" has no answer. The refund agent handles duplicate charges, service outage credits, fraud-adjacent disputes, and subscription proration errors. Those have different consequence profiles, different reversibility, different evidence availability, and different failure costs. A single autonomy setting across them is a decision to govern the easiest case and the hardest case identically, which means governing both wrongly.

Autonomy is a property of a bounded class of work under a stated set of conditions. It is never a property of an agent.

Defining a work class

A work class is useful only if membership is decidable before a consequential grant is issued, from structured evidence outside the model's self-classification. If deciding whether a case belongs requires the model to reason about it, the class boundary sits inside the compromised zone — Episode 04's distinction, applied to autonomy. It is also the same error Episode 02 named when it separated policy delivered as context from policy enforced as a constraint.

The volume requirement is the one that surprises teams. A work class too small to generate decision-grade evidence within a defensible window cannot be promoted honestly, and pretending otherwise is how a rare, high-consequence category ends up autonomous on the strength of forty observations.

The refund agent's classes

Six classes, six different correct answers. The last two may never be promoted, and saying so explicitly in the artifact is more valuable than leaving them undiscussed.

02The rungs, and how they map to consequence class

Five levels. The distinctions that matter are when the human acts and whether the action has already taken effect — not how sophisticated the agent is.

The industry shorthand of in-the-loop, on-the-loop, and out-of-the-loop maps onto this: humans intervening during execution, humans supervising afterward and flagging exceptions, and full autonomy for predetermined low-risk scenarios12.

The right-hand column is the important one, and it is what makes this episode a continuation rather than a new topic. The rung and the consequence class are the same variable observed at different timescales. Episode 02 already established that a run losing freshness verification drops from C3 Act to C2 Propose. Episode 03 established that a run with no authorizing basis for a C3 action degrades to C2, proposal only.

Those are demotions. They are already in your system, they already fire automatically, and they operate per run. Episode 06 adds the same mechanism at the level of a work class over weeks rather than a run over minutes.

Degraded mode is a demotion that lasts one run. A demotion is degraded mode that lasts until the evidence is rebuilt. One mechanism, two timescales.

That framing is worth carrying into the engineering conversation, because it means promotion and demotion should not be built as new machinery. They should reuse the consequence-class control that Episodes 01 through 03 already required.

Why R3 is the important rung

Most autonomy discussions jump from R1 to R4 because those are the two states people can picture. R3 is where most production value actually lives, and it is under-designed almost everywhere.

At R3 the agent acts without prior review, but a defined window exists in which the action can be reversed before irreversible or customer-visible finalization. The customer experience is autonomous. The risk profile is close to R1. The cost is engineering work to make reversal real — and that work is the entire point.

The R3 failure mode is specific and common: the window is declared but reversal was never built, tested, or resourced. A reversal window nobody has exercised is R4 with a comforting label.

The rung must be enforced structurally

The prologue drew the distinction the whole series rests on: a behavioral control instructs the agent, a structural control arranges the world so the agent cannot do otherwise. Episode 02 applied it to policy. Episode 03 applied it to authority ceilings — the ₹2,000 limit in a system prompt is not the same control as the ₹2,000 limit in the payment credential.

The same test applies here, and it is the first question to put to engineering.

A work class at R1 must be unable to obtain an execution grant without an approval reference. Not instructed not to — unable to. If a manipulated agent at R1 can reach the payment gateway by deciding it does not need approval, the rung was never real, and Episode 04's confused-deputy analysis explains exactly how that gets exploited.

03Reversibility is a design decision, not a fact

Teams treat reversibility as something they discover about an action. It is mostly something they build or decline to build.

The useful classification has three states, and the middle one carries most real work.

Guidance in the agent space converges on the same rule: classify every operation as reversible, compensable, or irreversible before the action, and set autonomy thresholds accordingly — the more irreversible the action, the less autonomy it should carry11. Risk-tier frameworks apply the same logic, treating reversibility as the key variable requiring classification before automation11.

Compensable is a distributed systems term, and the precision matters

This is not a soft distinction. It has a forty-year-old formal definition worth bringing to the engineering conversation.

The saga pattern, introduced by Garcia-Molina and Salem in 1987, decomposes a long transaction into a sequence of local transactions, each paired with a compensating transaction. The original paper is explicit about what compensation achieves: the compensating transaction undoes, from a semantic point of view, the actions performed by the original transaction — but does not necessarily return the database to the state that existed before it6. Modern treatments restate the same limit: compensating transactions logically reverse a business operation rather than restoring the exact prior state, which is described as the crucial distinction from a database rollback7.

That is the entire argument of this section, already settled in the literature. An engineer who has built sagas will recognize it immediately, and the recognition is useful, because it converts a product argument into a systems argument.

Reclaiming a refund is not undoing a refund. It is a second consequential action against a customer who has already been told they were refunded. Treating it as equivalent in an autonomy proposal is the most common analytical error in this area.

What buying reversibility looks like

Reversibility is purchasable, and the price is usually modest relative to the autonomy it unlocks. This is the most useful thing an AI PM can ask engineering for in this conversation.

A short delayed-execution queue can convert a large class of immediately irreversible actions into time-bounded reversible ones. Suppressing customer notification during the reversal window is what makes R3 genuinely low-risk rather than nominally low-risk — if the customer has already been emailed, reversal has become compensation.

Before arguing about how much autonomy an action deserves, ask what it would cost to make the action reversible. The second question is usually cheaper to answer than the first.

Reversal needs its own authority, and Episode 03 says why

This is the technical detail most R3 designs get wrong, and it is worth raising early because it changes the Authority Matrix.

Episode 03 specified that the refund grant is policy-authorized, bound to case and transaction, capped at ₹2,000, and valid for five minutes. Short-lived, just-in-time, expiring with the action. That is correct design.

Now declare a thirty-minute reversal window. The window outlives the grant by twenty-five minutes. At the moment reversal is needed, the authority that performed the action no longer exists.

Four consequences follow, and all four belong in the artifact rather than in a later bug report.

A reversal window whose authority expires before the window does is not a window. The Authority Matrix must carry a reversal grant as a first-class row, and Episode 02's teardown specification must be checked: if reversal requires workspace state that is destroyed at run completion, the window is fictional.

04What evidence earns a promotion

This is the core of the episode and the section to bring to the room.

A promotion proposal is a claim that a specific gate no longer reduces enough expected harm to justify its latency, operating cost, and cognitive burden. That claim requires evidence across all five prior episodes, because a gate compensates for weaknesses in all of them.

The five-gate standard

Every insufficient answer on the right is real, and each has appeared in an actual promotion proposal. The Episode 05 row is the most abused: an aggregate accuracy figure says nothing about the work class you are proposing to promote, and Episode 05's segmentation rule exists precisely to prevent this.

The Episode 02 row is the most overlooked. A gate is a freshness control nobody labels as one — a human reviewing a case will notice that the account status looks wrong in a way the agent will not. Removing the gate removes an informal check on the manifest's freshness budgets. If those budgets were never actually verified in production, promotion is the moment that gap becomes visible.

The seven conditions

A promotion is defensible when all seven hold. Fewer than seven is not a partial case for promotion; it is a case for waiting.

1. The work class is bounded and pre-decidable. Membership does not depend on model judgment, and the rule is enforced structurally.
2. Reversibility is established and exercised. The reversal path has run end to end in a target-equivalent environment and, where exposure permits, in a bounded production canary. Its authority outlives the reversal window. Untested reversal is not reversibility.
3. Quality is demonstrated for this class specifically, segmented per Episode 05, over a period long enough to include the downstream evidence window.
4. The gate's actual contribution is measured. See §05 — if the human approves 99% of cases in eleven seconds, the gate is not contributing what its presence implies.
5. The evidence survives substrate change. The class was promoted on evidence from a specific manifest and model version, both recorded in Episode 02's run attestation, and Episode 05's register says what happens when either is retired.
6. Fleet exposure at the new rung is calculated and accepted by a named owner, in monthly consequence-weighted terms, not per-case terms.
7. Demotion triggers are defined, instrumented, and tested before promotion takes effect. Not after.

A promotion without a working demotion path is not an expansion of autonomy. It is an abandonment of control with extra steps.

The canary requirement

Promotion follows progressive delivery discipline: roll the change to a small subset, observe under real traffic, expand incrementally, with the explicit purpose of limiting blast radius when the change is wrong13.

Applied to autonomy, with one adaptation that matters.

The shadow stage is the adaptation, and it is free. Before removing a gate, record the agent's proposed decision alongside the human's actual decision and measure disagreement. Every case the gate currently handles is already generating this comparison — most teams simply never persist it. Skipping shadow mode means discarding the cheapest and most direct evidence available to the decision.

One honest limit, which belongs in the artifact: shadow agreement measures agreement with the incumbent control, and the incumbent control has its own error rate. High agreement with a mediocre reviewer is not evidence of quality. Where the downstream outcome is observable, weight the outcome over the agreement.

05Measure what the gate is actually doing

A gate is a control, and Episode 05 established that controls have measurable availability and measurable error. Most promotion proposals argue the agent is good enough. Almost none establish what the human step was contributing.

Both halves are needed, because the decision is a comparison.

The overrides row splits the decision cleanly. A gate with a 0.4% override rate where overrides rarely improve the outcome is a formality. A gate with a 12% override rate where overrides prevent real loss is load-bearing, and removing it is a bad idea regardless of how good the accuracy number looks.

The oversight paradox

Bainbridge's 1983 argument about industrial automation applies directly and uncomfortably: automating most of the work leaves the human responsible for exactly the parts that could not be automated, while eroding the practice that made them competent to handle those parts. The deskilling problem becomes visible only after time has passed5.

For an approval gate, the mechanism is precise:

• The agent improves, so overrides become rarer.
• Rare overrides make review feel unnecessary, so attention falls.
• Lower attention reduces catch rate on the cases that still need catching.
• Reviewers see fewer hard cases, so their calibration on hard cases decays.
• The gate's measured contribution falls — and this is read as evidence the agent no longer needs it.

An approval gate degrades precisely as the system it oversees improves. Falling override rates are ambiguous between an agent that got better and a reviewer who stopped looking.

Resolving that ambiguity requires an active measurement, not a passive one.

Seeded cases

The only reliable way to measure a gate's detection ability is to give it something to detect. Regulatory guidance points the same direction: oversight design should include forced deliberation and controlled disagreement — including occasionally presenting deliberately incorrect recommendations to test overseer attention and measure automation bias4.

The last two rows are non-negotiable. The moment seeded cases are used for individual performance management, you have destroyed the measurement and created an adversarial relationship with the people your control depends on. Set that boundary in writing before the first seeded case runs.

One implementation note for engineering: a seeded case must be structurally incapable of execution, not merely flagged as non-executable. The cleanest mechanism reuses Episode 03 — issue no execution grant for seeded cases, so approval produces an authorization failure rather than a payment. A behavioral suppression here would be the same category error the series has warned about five times.

06What the human is being asked to decide

Episodes 03 and 04 established that an approval is a boundary only when the reviewer sees authoritative data and approves an exact, immutable intent from which a single-use grant is derived. This episode adds the requirement the regulation makes explicit.

EU AI Act Article 14 requires high-risk systems to be designed — including with appropriate human-machine interface tools — so they can be effectively overseen by natural persons while in use, with oversight measures commensurate with the risks, level of autonomy, and context of use1.

Read the enabling conditions as an interface specification, because that is what they are. The person assigned oversight must be enabled to understand the system's capacities and limitations and monitor its operation including detecting anomalies and unexpected performance; remain aware of the tendency to over-rely on system output — automation bias — particularly where the system provides recommendations for human decisions; correctly interpret output given available interpretation tools; decide in any particular situation not to use the system or to disregard, override, or reverse its output; and intervene or interrupt through a stop button or similar procedure bringing the system to a safe state1.

Two of those are frequently missing in practice.

"Decide not to use the system." Many review interfaces offer approve and reject on the agent's proposal. They do not offer handle this outside the agent entirely. Without that path, the reviewer's only options are shaped by the agent's framing, which is the definition of anchoring.

Awareness of automation bias. This is a design obligation on the interface, not a training obligation on the person. An interface that shows the agent's recommendation first, prominently, with a one-click approve, is engineered to produce automation bias regardless of what the training deck said.

The academic literature is direct: Article 14 requires providers to create the technical and operational conditions for effective oversight, while empirical evidence shows significant limitations arising from cognitive constraints and automation bias2. Article 14(4)(b) specifically requires that overseers remain aware of the tendency toward automatic reliance3. The provision is designed against a known failure mode. Build as if the failure mode is real, because it is.

Interface requirements that follow

The second row is a direct import from Episode 02 and is routinely missed. A reviewer shown "no prior refunds" cannot distinguish none exist from some exist outside your scope. Episode 02 required tools to return epistemic status to the agent. The same obligation applies to the human, and for the same reason: an invisible scope boundary becomes a factual claim the reviewer will act on.

The fourth row is the highest-value instrumentation in this episode. Capturing the reviewer's independent assessment before showing the recommendation, on even a small sample, converts automation bias from an assumption into a measured quantity — and it is the number that tells you whether your gate is real.

07Demotion is the harder artifact

Promotion is a decision made calmly with evidence on a slide. Demotion happens at 2am with incomplete information and a business cost attached. Design demotion first, because it is the part that will actually be exercised under pressure.

Two mechanisms, and confusing them causes real damage.

Standing triggers fire automatically, without discussion, because the conditions are unambiguous and time-critical.

Reviewed demotions are decisions made by a named owner on evidence, on a normal timescale.

Note that rows three and four are not new controls. They are Episode 02's existing degraded-mode conditions, promoted from per-run scope to per-class scope. The instrumentation already exists; what is missing is the persistence.

The capacity exception

If review capacity collapses, demoting to R1 sends more work to a queue that is already failing. The mechanical response makes the situation worse.

The correct response is to reduce eligible volume rather than change the rung — narrow the class membership rule, lower the consequence ceiling within the class, or pause the lowest-value segment entirely. Episode 05's contract already names this response; this episode makes explicit that it is not a demotion and must not be routed through the demotion path.

Not every degradation is answered by adding a human. Sometimes the correct answer is doing less work, not reviewing more of it.

Making the burn rate trigger work

Error budget policy supplies the mechanism. An error budget is one minus the SLO — a 99.9% objective yields a 0.1% budget, which over a million requests in four weeks is a budget of one thousand errors9. The budget functions as a control mechanism for diverting attention to stability as needed9, and burn-rate alerting determines when to slow or stop change10. Error budgets have been applied explicitly as a policy boundary for operational automation and autonomous remediation10 — which is precisely the use here.

The adaptation from Episode 05 carries forward: an agent quality budget is an estimate with error bars, not a ledger balance. That has four consequences for demotion design.

Trigger on the conservative bound. Waiting for the point estimate to cross means waiting for the uncertainty to resolve, and uncertainty resolves slowest exactly when volume is low — which is when high-consequence classes live.

Re-promotion is not automatic

After a demotion, the class returns to the promotion process. It does not auto-restore when the metric recovers.

This is deliberate and will be argued about. A metric recovering is not evidence the cause was addressed; it is frequently evidence that the population changed. Re-promotion requires the applicable seven conditions to be re-established, with one addition: a stated account of what caused the demotion and what changed. Absent that, the next demotion is the same demotion.

08The economics, honestly

Autonomy proposals are usually justified by cost. The arithmetic is nearly always done wrong, in a predictable direction.

The naive calculation: review costs X minutes per case; removing the gate saves X minutes times volume.

What that omits:

Episode 05's denominator is the right one: fully loaded cost per durable resolution, not cost per run. A promotion that reduces review minutes while increasing appeals, reversals, and rework has made the agent cheaper at being wrong.

Autonomy debt

Worth naming, because it accumulates quietly. Every promotion made on evidence thinner than the standard creates an obligation to either strengthen the evidence or reverse the promotion. Organizations rarely do either. The debt surfaces as a compliance question, an incident, or an auditor's question about why a control was removed — usually all three at once, eighteen months later, when nobody involved in the original decision is still on the team.

The record of why a gate was removed, under which versions and evidence window, is part of the deliverable. A promotion with no written evidentiary basis is a control removal with no owner.

09Translating this to your product

Five questions, whatever you build: What are your work classes, and is membership decidable before the run? Which actions could be made reversible cheaply? What is each existing gate actually catching? What would demote this, automatically? Who accepted the fleet exposure, in writing?

10The artifact

11Reviewing autonomy

Ninety minutes, quarterly, with the domain owner and the operations lead present. Not a standing item on a delivery review.

Five questions per promotion candidate. What is the work class, and is membership decidable before the run? Where is the rung enforced — grant issuance, or agent instruction? What is the gate currently catching, and how do you know? What is the reversibility mechanism, what authority performs it, and when was it last exercised in production? What demotes this automatically, and has that trigger fired in a drill?

Two questions for every existing rung. Would the evidence that justified this promotion still be accepted today? If the manifest or the model changed tomorrow, does this rung survive?

12Anti-patterns

• "The agent is 96% accurate." On which work class, segmented, over what window?
• "Should we make the agent autonomous?" Autonomy attaches to work classes.
• "The queue is eleven hours deep." An operations problem. Never evidence of readiness.
• "It's reversible — we can just reclaim the refund." That is a compensating transaction, which semantically offsets rather than restores6, and the customer has already been told.
• "We'll add a rollback path if we need one." Then you are at R4 with a label that says R3.
• "The autonomy level is in the system prompt." A behavioral control. The series has rejected this five times.
• "The reversal window is thirty minutes." And the execution grant expires in five. What authority reverses at minute twenty?
• "Overrides are down to 0.4%, so the gate isn't needed." Or reviewers stopped looking. Indistinguishable without seeded cases.
• "A human is still in the loop." Seeing the agent's summary, in eleven seconds, with a one-click approve?
• "We'll monitor it closely after launch." Name the trigger, the threshold, and the automatic response, or you will not.
• "The metric recovered, so let's re-promote." Recovery is not attribution.
• "It's a small category, so the risk is low." Low volume is a reason not to promote, because evidence cannot accumulate.
• "We upgraded the model, so it should be at least as good." Evidence is substrate-specific. Re-earn it.
• "Security signed off on the autonomy level." Security signs off on containment. Autonomy is a consequence decision.
• "Legal said human oversight is required, so we have an approver." Article 14 requires effective oversight — an interface and measurement obligation12.
• "We can always demote." Has the trigger fired in a drill? Who receives the volume?

13What product owns

1. Work class definitions — boundaries, membership rules, and change control.
2. The rung for each class, and which classes are declared permanently ineligible.
3. The enforcement requirement — that the rung is a property of grant issuance, not of agent instruction.
4. Reversibility investment — which irreversible actions are worth making reversible, and at what cost.
5. Reversal authority — that it exists, outlives the window, and does not depend on a live session.
6. The promotion evidence standard, and refusing proposals that do not meet it.
7. Gate contribution measurement, including the seeded case programme and its governance boundary.
8. Oversight interface requirements — what the reviewer sees, in what order, with what scope and freshness disclosure.
9. Standing demotion triggers, and the requirement that they be tested first.
10. The capacity exception — knowing when the answer is less work rather than more review.
11. Fleet exposure acceptance — a named signature, in monthly consequence-weighted terms.
12. The written record of why each gate was removed, kept for as long as the autonomy persists.

The envelope bounds what may happen. The manifest defines the world. The matrix establishes authority. The containment model states what survives compromise. The operating contract proves it all still holds. The autonomy ladder decides what that evidence has bought — and what takes it back.

The line

Autonomy is a property of a bounded class of work, never of an agent.

Degraded mode is a demotion that lasts one run. A demotion is degraded mode that lasts until the evidence is rebuilt.

Compensation is not reversal. The customer has already been told.

A reversal window whose authority expires before the window does is not a window.

An approval gate degrades precisely as the system it oversees improves.

A promotion without a working demotion path is an abandonment of control with extra steps.

Not every degradation is answered by adding a human.

Queue pressure is an operations problem. It is never evidence of readiness.

14The AI PM page

Print this. Bring it to the room.

Decisions you own

Twelve questions

1. What are the work classes, and is membership decidable before the run?
2. Where is the rung enforced — grant issuance, or agent instruction?
3. Is this reversible, compensable, or irreversible — and which have you assumed?
4. What authority performs the reversal, and does it outlive the window?
5. When was the reversal path last exercised in production?
6. What would it cost to make this action reversible?
7. What is the gate currently catching, and how do you know?
8. Is the override rate falling because the agent improved or because attention did?
9. Is the quality evidence segmented to this class, over the downstream window?
10. What is the monthly consequence-weighted exposure at the new rung?
11. What demotes this automatically, and has that trigger fired in a drill?
12. Who signed for the exposure, and would they sign again today?

Red flags

• A promotion proposal with an aggregate accuracy number.
• Queue depth cited as evidence of readiness.
• The rung implemented in the prompt or the orchestration code.
• "Reversible" used where the mechanism is compensation.
• A reversal window longer than the authority that would perform the reversal.
• A reversal path that has never been exercised.
• Falling override rates presented as unambiguous good news.
• No seeded case programme at any gate.
• No standing demotion trigger, or one that has never been tested.
• Nobody named as having accepted the exposure.
• No written record of why an existing gate was removed.

What you leave with

A work class inventory with pre-run decidable membership rules. A rung per class with a named enforcement point. A reversal authority specification. A reversibility classification with costed options to improve it. A gate contribution measurement per remaining gate. A standing demotion trigger list, drilled. A signed monthly exposure figure. A written evidentiary record for every gate already removed.

One line to carry out: A promotion without a working demotion path is an abandonment of control with extra steps.

→Next · Build Safe Realism

Six artifacts now govern the environment around the agent, and every one of them depends on evidence that had to be produced somewhere.

Episode 06 has just made that dependency acute. The seven promotion conditions demand production-grade evidence: reversal paths exercised, demotion triggers fired in drills, seeded cases replayed, shadow comparisons run at volume. Every one of those requires an environment realistic enough to produce meaningful results.

Which is the problem Episode 07 takes up. An environment realistic enough to generate promotion-grade evidence is realistic enough to cause real consequences. That is the fidelity paradox, and July 2026 supplied the case study: an evaluation environment carrying its own identity, its own network reach, and its own blast radius, governed as a test harness.

You cannot promote a work class on evidence from an environment that omitted the production property the claim depends on. Nor should the evaluation inherit real consequences the claim does not require. Episode 07 resolves that tension by separating fidelity from exposure and classifying environments by reachability rather than by label.