The envelope
starts closed, widens on evidenceConfirmedautonomous
Highautonomous
Mediumapprover
Hypothesis
< $10K$10–100K$100K–1M> $1M
Illustrative bands. Ceilings are set per decision type during scoping.
Platform / Autonomy & governance
Autonomy is granted per decision type, and it can be taken back.
The envelope starts closed. It widens where measured outcomes prove the system right, and narrows on its own when they stop — including when the world changes underneath a decision type that used to work.
01The envelopeSection 1 of 5
It starts closed, and widens only on evidence.
Autonomy is granted per decision type, at a named confidence, within a magnitude band.
02Envelope mechanicsSection 2 of 5
Four moving parts.
01
Per decision type
Autonomy is never granted to “the agent.” It is granted to a named decision type at a named confidence label, within a magnitude band.
02
Outcome-gated
A type moves inside the envelope after a minimum count of decisions whose measured outcome at T+7/14/30 matched the predicted impact within tolerance.
03
Magnitude-capped
Inside the envelope is not unlimited. Each type carries a value or exposure ceiling above which a named approver is required regardless of accuracy.
04
Automatic narrowing
Accuracy falling below the retention threshold, or a regime-change signal, moves a type back out. Narrowing does not require a human to notice.
03Ruin thresholdsSection 3 of 5
Some decisions never auto-execute, whatever the score says.
Irreversible
The action cannot be undone within the measurement window — funds disbursed, a customer terminated, a filing submitted.
Always
Named approver, always.
Fat-tailed
The loss distribution has no bounded worst case at the proposed magnitude.
Always
Named approver, always.
Correlated
The action repeats across a cohort, so a single wrong premise compounds instead of averaging out.
Capped
Batch cap plus approver.
Bounded
Reversible within the window, with a known worst case inside the ceiling.
Eligible
Eligible for autonomy.
i
These are circuit breakers, not confidence adjustments. A CONFIRMED label on an irreversible fat-tailed action still requires a human, because the question the label answers is not the question the breaker asks.
04Regime changeSection 4 of 5
Calibration assumes the world stays still. It doesn't.
A decision type earns autonomy against a distribution. When that distribution moves — a rate cycle, a channel mix shift, a platform algorithm change, a new product — historical accuracy stops predicting future accuracy, and the envelope has to close before the outcomes prove it.
The detector watches feature drift and residual structure on the fitted models, not just outcome accuracy, because accuracy is the lagging indicator. A drift signal moves affected types back to approver-required and flags the graph for re-seeding.
05The recordSection 5 of 5
It keeps the decisions it would not make.
Immutable and append-only, written whether the agent acted, waited, or was refused.
Tier 1, exact. All five checks passed.
Sample-size floor, n=3 against 5. The action was held and the reason kept.
heldtest returnedsigned
Above the ceiling. s.rao approved with the evidence attached.
Immutable and append-only, and it keeps the decisions it would not make.
Next
Then look at what your auditor will be handed.
Every decision, approval, deferral, execution and outcome, in one immutable record.