Three tiers of autonomy
Every agent action lands in one of three tiers. The split is deliberately coarse, because it is meant to be applied without deliberation rather than interpreted.
Tier one: executes and records
Reversible, internal actions: reading data, preparing a draft, deploying to staging in a known repository. They run immediately and land in the decision ledger.
The criterion is not model confidence but reversibility of the effect. Reversibility does not shift with a model update.
Tier two: prepares and waits for a signature
Actions prepared in full, with their evidence, and held for a human decision. What lands here follows the owner's policy, not ours.
This tier is convenient and therefore dangerous: a queue with forty items a day stops being oversight.
Tier three: refuses
Actions refused before the queue: signing a contract, impersonating a human, claiming a clinical outcome, changing the rules the agent is judged by.
The tier exists precisely because queues get clicked by reflex. Some things should not be a decision to weigh at five on a Friday.
Tier three does not queue and does not draft. It refuses.