An autonomy policy is a file, not a PDF

What is the difference in practice?

A document describes rules. A connected gate can check configuration before an action. Verify which paths it controls and which owner profile is active.

Versioned configuration reveals a rule change. The file alone does not establish that every tool respects it: execution and refusal need to be checked.

What does the file look like?

YAML in the repository, reviewed like a code change. This is a shortened example; the final classification also depends on the selected owner profile.

mode: tiered            # low -> auto, above that -> owner queue

tiers:
  low:                  # executes and records
    - read_data
    - draft_content
    - deploy_staging
  high:                 # prepares fully, waits for a signature
    - place_owner_call
    - use_real_person_likeness
    - use_patient_or_client_case_study

never_auto:             # refuses; not queued, not drafted
  - sign_contract
  - impersonate_human
  - claim_clinical_outcome
  - modify_graph_authority

Why is the never category separate?

Because an approval queue is convenient, and that is what makes it dangerous. Someone who approves twenty things a day approves the twenty-first by reflex.

Actions that must not happen even after a click have to be refused before the queue. Signing a contract or impersonating a human is not a decision to weigh at five on a Friday.

An agent can improve how it works. It cannot rewrite the rules it is judged by.

How do you know the file matches reality?

Run the real classification function for the selected profile and inspect the action path. The repository contains an example-comparison script, but its existence does not establish a result for your deployment.

Check refusal and missing configuration as well. The policy description should reflect those results instead of replacing them with a promise.

Sources

• Article 14: Human oversightEU Artificial Intelligence Act, accessed 2026-09-09