Three tiers of autonomy
Actions on policy-connected paths are classified for automatic execution, approval or refusal. This is an example split; the selected owner profile determines actual permissions.
Tier one: executes and records
Reversible, internal actions: reading data, preparing a draft, deploying to staging in a known repository. They run immediately and land in the decision ledger.
Reversibility helps assess risk. It is not sufficient on its own: permissions, data and the selected policy also matter.
Tier two: prepares and waits for a signature
Actions prepared in full, with their evidence, and held for a human decision. What lands here follows the owner's policy, not ours.
This tier is convenient and therefore dangerous: a queue with forty items a day stops being oversight.
Tier three: refuses
Actions refused before the queue: signing a contract, impersonating a human, claiming a clinical outcome, changing the rules the agent is judged by.
The tier exists precisely because queues get clicked by reflex. Some things should not be a decision to weigh at five on a Friday.
Tier three does not queue and does not draft. It refuses.