GlossaryGlosarium
What is per-action autonomy?What is per-action autonomy?
Per-action autonomy means every class of work gets its own rung on a three-step ladder — draft, opt-in-auto, or never — instead of one switch for the whole agent. An unset class behaves as never, never is a floor, and the narrower of the pack and the organisation always wins.Per-action autonomy means every class of work gets its own rung on a three-step ladder — draft, opt-in-auto, or never — instead of one switch for the whole agent. An unset class behaves as never, never is a floor, and the narrower of the pack and the organisation always wins.
Glossary / What is per-action autonomy?
Per-action autonomy is the decision to set permission per class of work rather than per agent. One agent can hold six classes — observing a channel, drafting a promotion, chasing an RSVP, assembling a report, escalating to a human, notifying a member — and those six do not deserve one shared answer. In the shipped event-operations pack, reading is allowed to run on its own, drafting a promotion is not, and sending an individual message is not even present in the toolset.
The ladder has three rungs. `draft` means the fleet may write the message but a human must read and approve it before anything happens. `opt-in-auto` means the fleet may run the class on its own, but only while a live grant covers it. `never` means the class does not happen.
Four rules make the ladder real rather than decorative. Default is deny: a class that was never declared behaves as `never`, so an unset key is not a loophole. `never` is a floor: no runtime operation widens it, and the only way to change it is an edit to the pack file, which the validator holds to the pack's own invariants. Narrowing always wins: an organisation's ceiling, a freeze on a channel, the partner gate and any future preset can only pull a class down. And a member's own input narrows an automatic lane to `draft` — "yes, go ahead" typed into the group chat is input to a proposal, never a grant.
That last rule is why the organisation tier cannot be a remote control. An organisation may narrow any class its packs declare, and it may fill a blank a pack never wrote, but it cannot widen a class and cannot resurrect one that a pack made absent. The narrower of the two always wins, and it fails closed.
Related
| Term | |
|---|---|
| What is the opt-in-auto rung?opt-in-auto is the rung where the fleet may run a class on its own — but only while a live grant covers it. It is opt-in twice over: someone has to grant it, and the grant can be revoked. With no live grant, the class falls back to a card for the human seat. | Read → |
| What are once-vs-always grants?A grant is a permission the human seat issues for one action class. It comes in two kinds: allow_once, consumed after a single use, and allow_always, which must name the scope it covers. Collapsing the two is the bug that turns a helper into an unattended bot. | Read → |
| What is the human seat?The human seat is the one named person allowed to decide a proposal, issue or revoke a grant, and release a freeze. Every member-facing message the fleet produces passes through it first. It is a role, not a password, and the control plane ships with exactly one. | Read → |
By Filbert Then · Last updated · Suggest a correction
See the fleet runLihat armadanya berjalan
Run the seeded cycle, decide the proposals, then read the audit trail.Jalankan siklus contoh, putuskan usulannya, lalu periksa audit trail-nya.