Back matter

Appendix · Climbing: what changes as autonomy rises

This appendix runs three scenarios, and the hardest of them is an autonomous monitoring agent that acts alone, rung 5, with nothing between it and the world. Part Two walks the balanced case; this appendix is where the top of the ladder is described, and the cells marked are the ones that change most sharply with altitude.

A note on the columns. They are named rather than numbered, because a given product will not have every rung on it and the names stay true when the numbers do not apply. Design numbers them where it teaches the ladder, and the mapping is the obvious one: suggests, drafts, acts with approval, acts with oversight, acts alone. Ostermill has no meaningful rung 3: when the only action is sending, a draft a person releases and a send a person approves are the same event. Read the names.

A note on the vocabulary. Several terms in the cells are built at length in the other four books rather than in this one, and are used here in their series senses: deference and provenance marks, the silence budget, storm behavior, the suppression log, canary releases by task class, the supervision RACI. Two are worth stating outright, because the cells assume them. A storm is a burst of correlated events arriving faster than any reviewer can read them, which is the condition under which an agent at the top of the ladder is least supervised and most consequential. A supervision RACI is the matrix naming who is responsible, accountable, consulted and informed when the agent acts with no reviewer in the path. An async contract is the set of commitments a long-running agent makes about how it reports in and how it can be stopped: heartbeats while it works, checkpoints it can resume from, and what happens to work in flight when somebody interrupts it. The rest are named here and built elsewhere in the series; the cells assume them rather than define them.

The agent in the right-hand column. It is worth meeting before the tables, because every cell is about it. An autonomous monitoring agent watches a platform's telemetry, decides on its own which anomalies are worth a ticket, and files them into the queue that a support organization works. Nobody approves a ticket. The platform budget pays for the agent; the support organization pays for every false one, in triage minutes. It has no approval screen, because there is no moment at which a person is asked. That is the whole difference, and every row below is a consequence of it.

The Ostermill case is a deliberately balanced example: drafting only at launch, one capability revoked, one earned back, and a person who reads every send. Your agent sits somewhere else on the ladder, and the phases do not simply get harder as you climb. They change shape.

This appendix is the delta table. What each phase additionally demands at each altitude, built by walking three scenarios through the same five phases: a rung-1 copilot that suggests, the Ostermill agent that drafts, and an autonomous monitor that acts alone.

One sentence to hold before the tables, and it is Chapter 10's: the rung sets the weight.

Low on the ladder the effort concentrates in Design, because a person is in every loop and the interaction is the product. High on the ladder the effort moves to Observe and Operate, because nobody is in the loop and the evidence that nobody needs to be is the product. Budget for that in calendar as well as money. Proof gets more expensive with altitude, which is why a copilot pilot fits inside a month and an autonomous agent's honest rehearsal alone runs six weeks or more.

The five rungs, by name

RungNameWhat the person does
1SuggestsEverything. The agent surfaces, the person decides and acts
2DraftsReleases. The artifact is real, the risk is not yet
3Acts with approvalGates. The agent is going to act; the person is a check, not an author
4Acts with oversightWatches the aggregate. Nobody approves each case
5Acts aloneReads the instruments, or nothing

The break sits between 2 and 3, and it is the only gap on this ladder that is a change in kind rather than degree. Below it a mistake costs a deleted draft rather than a sent letter, because a hand sits between the output and the world. Above it the system touches state.

Rung 1 is wider than it looks, and it is the rung most products are actually on. "The agent surfaces and the person decides" covers a range that behaves very differently at its two ends. Take four outputs about the same account, in ascending order of how much they decide for the reader: accounts at this age are sometimes escalated; accounts like this one are usually escalated; I would escalate this account; escalate this account today. Nothing there changes what the software does. All four surface, none acts, a person still types the next thing. What changes is how much judgment has been spent before the person arrives, and by the last one the decision is made and the person is ratifying it.

Two consequences, both practical. A product can climb most of this rung with no engineering change, because tightening the wording is a prompt edit no gate reviews. And a disclaimer does not move it back down: check with your controller leaves the sentence exactly as directive, and lets the room feel the question is handled.

How to use this

Find your agent's riskiest task on the ladder, not its average task. Read that column down the five phases. The cells are the additions to the balanced path Part Two walked.

Then read one column to the left. That is what you may deliberately postpone, and it is also the bill your next promotion makes due.

Decide

SuggestsDrafts, the Ostermill pathActs alone
The alternative is a template, a macro, or a feature. The review is shortThe alternative is a person's workflow, and the ledger has to price their review minutesThe alternative is the alerting stack you already own. The census is the opening act, not an afternoon: three systems already filed tickets on their own, two had no findable owner
Kill number on acceptance and correctnessKill number on a behavior the reviewer cannot improve by tiring. Not approval-without-edit; Observe retires that one for exactly this reasonKill number on precision and a noise ceiling
The funding question is a formality: one desk funds the accuracy and absorbs the errorsFunder and truster are usually the same deskFunder and sufferer are different organizations: the platform budget pays for accuracy, support pays for every false ticket in triage minutes. Add the false-positive tax, priced with the people who pay it

Design

SuggestsDrafts, the Ostermill pathActs alone
The approval surface is the product. Deference marks on every suggestionThe approval moment: decision package, a time budget, three actions, and an interruption budget, so the count of approvals is chosen rather than inheritedNo approval moment. The queue is the surface, and a suppressed-action log replaces "what the reviewer could not see"
Identity: acts under the user's delegated identityOwn identity, scoped to the tasks in the declarationOwn identity plus a rehearsed one-motion revocation. The kill switch is a credential dying, and the honest version has a measured time on it
Short, because the boundary is short and the vocabulary sharedWalls on what it may touch, fences named as fences in the briefTwo weeks, because the walls are the product. Nothing sits between the agent and the world, so every "must never" is enforced in the path or is not true
Memory is a convenienceA policy conversation with an owner: categories, retention, audience, and the capability the constraint costsAn architecture problem. Memory is the model of what normal looks like, so deleting it degrades detection. A retention limit is a capability decision wearing a compliance costume
Guardrails are cheap insurance nobody expects to fireCeilings, circuit breakers and burn alerts, still mostly insuranceThe primary safety mechanism: no approval step absorbs a mistake, and the task has no natural stopping point. Low on the ladder they are insurance; high on it, the design
No async contract needed; every exchange is synchronousA silence budget for batch runsThe async contract is central: heartbeats, checkpoints, storm behavior, interruption semantics

Prove

SuggestsDrafts, the Ostermill pathActs alone
Eval covers correctness of suggestions. The deterministic half is classic QA and stays that wayEval covers the judgment slice, in both directions: the do-something cases and the do-nothing casesSuppression is the product. The do-nothing rows dominate the set, and severity calibration earns its own suite
The state gate is a small addition, because almost nothing the agent claims is an action; the person who presses send is the state changeThe state gate catches the claimed-but-not-done caseThe state gate is the eval. Cases end in something happening where nobody is watching, so semantic validation certifies the narration, and the narration is not the product
Rehearsal: replay against history, daysShadow against live work, weeksShadow until the disagreement rate stabilizes, six weeks or more, plus a storm drill
Two of the four questions bite: cost and interventionAll four questions, four named owners, and most answers can still be qualified with "and someone will see it before it goes"The qualifier is gone from all four. Rollback time becomes the blast radius; cost per outcome has no human line to hide behind. The questions do not change with the rung. What changes is that nothing absorbs a wrong answer

Observe

SuggestsDrafts, the Ostermill pathActs alone
Two instruments earn their keep: acceptance quality, and a periodic correctness auditThe six instruments, with baselines carried over from the rehearsalThe six, re-aimed. Override becomes closed-as-noise. Ceiling proximity and burn rate join the readout
The collapse arrives through the accept button: accepted-but-wrongThe collapse arrives through review depth: the signature that looks like a review. Report the fastest decile or do not report itThe collapse arrives through desensitization: the organization learns to ignore the agent, and the metric that shows it is the one nobody built
Affected people are consumers of the output, reachable through provenance marksAffected people are customers on the receiving end, reachable through the case recordAffected people are often an internal organization, the queue owners, and their metrics belong in your readout rather than theirs

Operate

SuggestsDrafts, the Ostermill pathActs alone
Drift arrives from upstream semantics: definitions change under the draftsDrift arrives from case mix and model updatesDrift arrives from seasonality. Review has to be calendar-aware or it reads a season as a regression
Incidents are quality complaints; recovery is a correctionIncidents carry a clock and a notification dutyIncidents include the storm and the missed suppression. Constitutional rules and ceilings are the last line, because nothing else is standing there
Upgrades: re-run the suite before the new model drafts anythingPersonnel protocol: regression, behavioral change notes, supervised return, reviewers told in advancePersonnel protocol plus canary by task class. The predecessor stays warm until the successor has earned the queue
The seat is a named reviewer with hours in their weekThe seat is a supervisory role with a line in the ledger and time that is actually allocatedThe seat spans two organizations, and the supervision RACI has to include the queue owners
Recoverable: somebody reads every output, so accommodations stay inside a loop with a person in itThe reviewer's discomfort usually arrives before the diff doesNobody has read anything, so no discomfort arrives first. The declaration and the cumulative diff against it are the only instrument that can detect what the product has become. Low on the ladder the diff records drift; high on it, the diff is what finds it
Retirement: the eval set and the corrections transferRetirement: credential dies, sealed records outlive the agent, absorbed work is rehomedThe same, plus the suppression log: the rarest asset in this book, a record of judged silence