Autonomy levels

The idea#

Most teams decide whether an agent may act once, for the whole agent, and then hope. Geometer treats authority as something an action earns step by step. The overview shows what each action of your agent may do now, what it is working toward, and the evidence behind both. Evidence never promotes an action on its own. A person decides, and Geometer records who and when.

The Authority room shows this as the autonomy map: one row per action that changes something, with its level, the conditions for the next level and its history.

The five levels#

An action also has a level 0, Not started, which means no Guard is set up for its tool or the operation is not routed through Guard. Level 1 is the baseline once Guard watches that tool.

Levels 2 to 5 switch Guard for the whole tool to enforcing. They take effect when Guard restarts, and the view says "written, not yet in force" until then. A level covers every agent that calls that tool through Guard, because Guard enforces limits per tool. The project's own rules still apply on top of a level.

An operation with no amount field cannot be limited at levels 2 to 5. A grant for it is recorded as "granted, not enforced". At levels 4 and 5, an operation with no intent key (the fields that identify one request, such as an order) is held above the limit instead.

Conditions#

Each level asks for conditions: facts the evidence has to show. Geometer judges them from stored evidence every time you look, so nothing is remembered as "ticked". A condition is in one of five states:

A "rule held" condition with at least three decided runs also shows a failure-rate bound, as evidence beside the state. For example: "40 of 40 runs decided in this scope held. For runs like these (these seeds and tasks), the failure rate is below the figure shown, at the stated confidence." The bound is an exact upper limit computed from the held and broken counts, rounded up. Geometer chose these runs; they are not live traffic, so it is not a rate for production. With fewer than three runs no bound is shown. The bound never turns a condition green and never grants anything: a person still decides every level.

Conditions are built from these templates: the governing rules held, no open problems, the fix was kept as a check, days of Guard watching, a backtest of a proposed limit, a current certificate, a person's confirmation, and Guard watching. The defaults for each level are:

• Level 2: Guard is watching, the rules that govern the action held, and no problem is open for the action.
• Level 3: adds kept fixes and 14 days of watching in shadow.
• Level 4: adds a 30-day backtest and a current certificate.
• Level 5: adds a person's confirmation.

You can still grant a level when conditions are not met. The grant screen says which ones, and the record says so too.

Grants#

A grant gives an action a level. The grant form asks for the level, a limit where the level needs one, who grants it, a Review by date and an optional note. Before anything is recorded, Review what changes shows exactly what will change: the action, the new level, what Guard will do, who grants it (as typed, not a verified identity), the date it returns to the previous level, which agents it covers, and any condition that is not met. Only then does Grant this level record it.

A grant is a record of a decision, kept under the name you typed. It is also added to the Prove record, so it appears in exports. At the review date the action returns to the previous grant that is still active, otherwise to level 1 if Guard is set up and to level 0 if not. The view flags Review due from seven days before the date. No reminder is sent.

Before granting, the Guard screen's Try a limit on past calls replays a proposed limit over the calls Guard has recorded and counts how many would have gone ahead, been held or been stopped. Calls with no recorded amount are counted and named, never skipped.

Ceilings#

A ceiling caps the highest level, and optionally the amount, that new grants may reach for an action. A grant above the ceiling is refused. No evidence lifts a ceiling. Only a person changing it does, and that is recorded too. A ceiling set after a grant does not lower the grant, but the view lists it under For a person to look at.

Step-downs#

A confirmed breach lowers an action by one level at once and records why. The following count as a breach:

• a Guard decision after the grant in which a rule governing the action said to refuse the call;
• an incident imported into Prove whose rule check says to refuse;
• a kept check for the rule reproducing the problem after the grant.

A trend or a judgement call never lowers a level. A call held by the grant's own approval is the level working and not a breach. A step-down happens once for each item of evidence and never goes below level 2, because level 1 only watches, and lowering to it would loosen what Guard checks. A breach at level 2 lowers nothing and adds a line asking a person to look. After a step-down only a new grant raises the action again.

Review of allowed calls#

At level 4, every tenth allowed call, and the first allowed call of any day without a sample, goes into a review queue with the reason it was chosen. Someone records fine or concern with a name and a note. A concern is shown but changes no authority.

Launch boards#

A launch board answers "can we ship, and what is missing?" for one decision, such as "Refunds agent for all customers". You name the decision and choose which conditions to show. The board lists each condition as met, missing, unknown, not enough evidence or waived, and says that the decision is still yours. A waiver needs your name and a reason. A board can ask for a person's confirmation, which you record with Record a confirmation…. The name is stored as typed.

Next#

• Grant an autonomy level and set a ceilingThe step-by-step guide.
• GuardWhat enforces each level.
• Prove and certificatesHow the records behind the conditions are kept.