Autonomy policy: what an agent may do alone
An autonomy policy answers one question, asked on every agent action: may this happen without asking. The answer has to be executable, not descriptive.
Why a file rather than a document?
Because a document is read by a person when they remember it, and a file is read by the gate on every action. A rule you have to remember works exactly as well as memory does.
A file is also versioned. Changing an agent's permissions then looks like a code change: you can see who made it and when.
What is in it?
Three lists and a mode. The lists assign actions to tiers; the mode decides how strictly the tiers are enforced.
- Actions that execute alone and are recorded: reading data, drafting content, deploying to staging in a known repository.
- Actions prepared in full and held for the owner's signature.
- Actions refused every time, regardless of mode and regardless of who asks.
- An owner profile that can narrow or widen the tiers for a specific person.
How do you know the description matches the file?
By running it. Before this page is published, a script calls the real classification function for every action listed here and compares the result with the page. A mismatch stops publication.
That solves a specific problem: a policy description on a marketing page tends to age faster than the policy itself.
An agent can improve how it works. It cannot rewrite the rules it is judged by.