Appendix · Climbing: what changes as autonomy rises
This appendix runs three scenarios, and the hardest of them is an autonomous monitoring agent that acts alone, rung 5, with nothing between it and the world. Part Two walks the balanced case; this appendix is where the top of the ladder is described, and the cells marked are the ones that change most sharply with altitude.
A note on the columns. They are named rather than numbered, because a given product will not have every rung on it and the names stay true when the numbers do not apply. Design numbers them where it teaches the ladder, and the mapping is the obvious one: suggests, drafts, acts with approval, acts with oversight, acts alone. Ostermill has no meaningful rung 3: when the only action is sending, a draft a person releases and a send a person approves are the same event. Read the names.
A note on the vocabulary. Several terms in the cells are built at length in the other four books rather than in this one, and are used here in their series senses: deference and provenance marks, the silence budget, storm behavior, the suppression log, canary releases by task class, the supervision RACI. Two are worth stating outright, because the cells assume them. A storm is a burst of correlated events arriving faster than any reviewer can read them, which is the condition under which an agent at the top of the ladder is least supervised and most consequential. A supervision RACI is the matrix naming who is responsible, accountable, consulted and informed when the agent acts with no reviewer in the path. An async contract is the set of commitments a long-running agent makes about how it reports in and how it can be stopped: heartbeats while it works, checkpoints it can resume from, and what happens to work in flight when somebody interrupts it. The rest are named here and built elsewhere in the series; the cells assume them rather than define them.
The agent in the right-hand column. It is worth meeting before the tables, because every cell is about it. An autonomous monitoring agent watches a platform's telemetry, decides on its own which anomalies are worth a ticket, and files them into the queue that a support organization works. Nobody approves a ticket. The platform budget pays for the agent; the support organization pays for every false one, in triage minutes. It has no approval screen, because there is no moment at which a person is asked. That is the whole difference, and every row below is a consequence of it.
The Ostermill case is a deliberately balanced example: drafting only at launch, one capability revoked, one earned back, and a person who reads every send. Your agent sits somewhere else on the ladder, and the phases do not simply get harder as you climb. They change shape.
This appendix is the delta table. What each phase additionally demands at each altitude, built by walking three scenarios through the same five phases: a rung-1 copilot that suggests, the Ostermill agent that drafts, and an autonomous monitor that acts alone.
One sentence to hold before the tables, and it is Chapter 10's: the rung sets the weight.
Low on the ladder the effort concentrates in Design, because a person is in every loop and the interaction is the product. High on the ladder the effort moves to Observe and Operate, because nobody is in the loop and the evidence that nobody needs to be is the product. Budget for that in calendar as well as money. Proof gets more expensive with altitude, which is why a copilot pilot fits inside a month and an autonomous agent's honest rehearsal alone runs six weeks or more.
The five rungs, by name
| Rung | Name | What the person does |
|---|---|---|
| 1 | Suggests | Everything. The agent surfaces, the person decides and acts |
| 2 | Drafts | Releases. The artifact is real, the risk is not yet |
| 3 | Acts with approval | Gates. The agent is going to act; the person is a check, not an author |
| 4 | Acts with oversight | Watches the aggregate. Nobody approves each case |
| 5 | Acts alone | Reads the instruments, or nothing |
The break sits between 2 and 3, and it is the only gap on this ladder that is a change in kind rather than degree. Below it a mistake costs a deleted draft rather than a sent letter, because a hand sits between the output and the world. Above it the system touches state.
Rung 1 is wider than it looks, and it is the rung most products are actually on. "The agent surfaces and the person decides" covers a range that behaves very differently at its two ends. Take four outputs about the same account, in ascending order of how much they decide for the reader: accounts at this age are sometimes escalated; accounts like this one are usually escalated; I would escalate this account; escalate this account today. Nothing there changes what the software does. All four surface, none acts, a person still types the next thing. What changes is how much judgment has been spent before the person arrives, and by the last one the decision is made and the person is ratifying it.
Two consequences, both practical. A product can climb most of this rung with no engineering change, because tightening the wording is a prompt edit no gate reviews. And a disclaimer does not move it back down: check with your controller leaves the sentence exactly as directive, and lets the room feel the question is handled.
How to use this
Find your agent's riskiest task on the ladder, not its average task. Read that column down the five phases. The cells are the additions to the balanced path Part Two walked.
Then read one column to the left. That is what you may deliberately postpone, and it is also the bill your next promotion makes due.
Decide
| Suggests | Drafts, the Ostermill path | Acts alone |
|---|---|---|
| The alternative is a template, a macro, or a feature. The review is short | The alternative is a person's workflow, and the ledger has to price their review minutes | The alternative is the alerting stack you already own. The census is the opening act, not an afternoon: three systems already filed tickets on their own, two had no findable owner |
| Kill number on acceptance and correctness | Kill number on a behavior the reviewer cannot improve by tiring. Not approval-without-edit; Observe retires that one for exactly this reason | Kill number on precision and a noise ceiling |
| The funding question is a formality: one desk funds the accuracy and absorbs the errors | Funder and truster are usually the same desk | Funder and sufferer are different organizations: the platform budget pays for accuracy, support pays for every false ticket in triage minutes. Add the false-positive tax, priced with the people who pay it |
Design
| Suggests | Drafts, the Ostermill path | Acts alone |
|---|---|---|
| The approval surface is the product. Deference marks on every suggestion | The approval moment: decision package, a time budget, three actions, and an interruption budget, so the count of approvals is chosen rather than inherited | No approval moment. The queue is the surface, and a suppressed-action log replaces "what the reviewer could not see" |
| Identity: acts under the user's delegated identity | Own identity, scoped to the tasks in the declaration | Own identity plus a rehearsed one-motion revocation. The kill switch is a credential dying, and the honest version has a measured time on it |
| Short, because the boundary is short and the vocabulary shared | Walls on what it may touch, fences named as fences in the brief | Two weeks, because the walls are the product. Nothing sits between the agent and the world, so every "must never" is enforced in the path or is not true |
| Memory is a convenience | A policy conversation with an owner: categories, retention, audience, and the capability the constraint costs | An architecture problem. Memory is the model of what normal looks like, so deleting it degrades detection. A retention limit is a capability decision wearing a compliance costume |
| Guardrails are cheap insurance nobody expects to fire | Ceilings, circuit breakers and burn alerts, still mostly insurance | The primary safety mechanism: no approval step absorbs a mistake, and the task has no natural stopping point. Low on the ladder they are insurance; high on it, the design |
| No async contract needed; every exchange is synchronous | A silence budget for batch runs | The async contract is central: heartbeats, checkpoints, storm behavior, interruption semantics |
Prove
| Suggests | Drafts, the Ostermill path | Acts alone |
|---|---|---|
| Eval covers correctness of suggestions. The deterministic half is classic QA and stays that way | Eval covers the judgment slice, in both directions: the do-something cases and the do-nothing cases | Suppression is the product. The do-nothing rows dominate the set, and severity calibration earns its own suite |
| The state gate is a small addition, because almost nothing the agent claims is an action; the person who presses send is the state change | The state gate catches the claimed-but-not-done case | The state gate is the eval. Cases end in something happening where nobody is watching, so semantic validation certifies the narration, and the narration is not the product |
| Rehearsal: replay against history, days | Shadow against live work, weeks | Shadow until the disagreement rate stabilizes, six weeks or more, plus a storm drill |
| Two of the four questions bite: cost and intervention | All four questions, four named owners, and most answers can still be qualified with "and someone will see it before it goes" | The qualifier is gone from all four. Rollback time becomes the blast radius; cost per outcome has no human line to hide behind. The questions do not change with the rung. What changes is that nothing absorbs a wrong answer |
Observe
| Suggests | Drafts, the Ostermill path | Acts alone |
|---|---|---|
| Two instruments earn their keep: acceptance quality, and a periodic correctness audit | The six instruments, with baselines carried over from the rehearsal | The six, re-aimed. Override becomes closed-as-noise. Ceiling proximity and burn rate join the readout |
| The collapse arrives through the accept button: accepted-but-wrong | The collapse arrives through review depth: the signature that looks like a review. Report the fastest decile or do not report it | The collapse arrives through desensitization: the organization learns to ignore the agent, and the metric that shows it is the one nobody built |
| Affected people are consumers of the output, reachable through provenance marks | Affected people are customers on the receiving end, reachable through the case record | Affected people are often an internal organization, the queue owners, and their metrics belong in your readout rather than theirs |
Operate
| Suggests | Drafts, the Ostermill path | Acts alone |
|---|---|---|
| Drift arrives from upstream semantics: definitions change under the drafts | Drift arrives from case mix and model updates | Drift arrives from seasonality. Review has to be calendar-aware or it reads a season as a regression |
| Incidents are quality complaints; recovery is a correction | Incidents carry a clock and a notification duty | Incidents include the storm and the missed suppression. Constitutional rules and ceilings are the last line, because nothing else is standing there |
| Upgrades: re-run the suite before the new model drafts anything | Personnel protocol: regression, behavioral change notes, supervised return, reviewers told in advance | Personnel protocol plus canary by task class. The predecessor stays warm until the successor has earned the queue |
| The seat is a named reviewer with hours in their week | The seat is a supervisory role with a line in the ledger and time that is actually allocated | The seat spans two organizations, and the supervision RACI has to include the queue owners |
| Recoverable: somebody reads every output, so accommodations stay inside a loop with a person in it | The reviewer's discomfort usually arrives before the diff does | Nobody has read anything, so no discomfort arrives first. The declaration and the cumulative diff against it are the only instrument that can detect what the product has become. Low on the ladder the diff records drift; high on it, the diff is what finds it |
| Retirement: the eval set and the corrections transfer | Retirement: credential dies, sealed records outlive the agent, absorbed work is rehomed | The same, plus the suppression log: the rarest asset in this book, a record of judged silence |