Autonomy policy: what an agent may do alone
An autonomy policy answers one question, asked on every agent action: may this happen without asking. The answer has to be executable, not descriptive.
Why a file rather than a document?
Because a document is read by a person when they remember it, and a file is read by the gate on every action. A rule you have to remember works exactly as well as memory does.
A file is also versioned. Changing an agent's permissions then looks like a code change: you can see who made it and when.
What is in it?
Three lists and a mode. The lists assign actions to tiers; the mode decides how strictly the tiers are enforced.
- Actions that execute alone and are recorded: reading data, drafting content, deploying to staging in a known repository.
- Actions prepared in full and held for the owner's signature.
- Actions refused every time, regardless of mode and regardless of who asks.
- An owner profile that can narrow or widen the tiers for a specific person.
How do you check that the description matches execution?
Run the real classification function for the selected profile and inspect the execution path. An example-comparison script exists in the repository; its result must be verified for the actual configuration.
That solves a specific problem: a policy description on a marketing page tends to age faster than the policy itself.
An agent can improve how it works. It cannot rewrite the rules it is judged by.