Graduated agent authority

The three words are not synonyms. Capability is a property of the model, measurable on benchmarks. Authority is a scoped, revocable grant — what this agent is permitted to touch, for this task. Autonomy is whether it proceeds without asking, and that is an organizational permission somebody earns, not a feature that ships. Security and observability both answer questions about can; the missing layer is may. And the prerequisite for climbing at all is inverted from the usual intuition: good CI, deploy infrastructure and evals are what let you release control, not the reward for having released it.

The sharpest version of the ladder makes the rung a per-change judgment on three axes: how likely the agent is to get it wrong, how much it costs if it does, and — the one usually omitted — whether anyone would notice. Detectability comes first in practice, because it starts with knowing what right and wrong even mean for this change. Review depth then follows business criticality rather than a uniform rule, and risk scoring on the change itself lets low-risk work move fast without widening the gate for everything.

Borrowing the self-driving levels turns out to be more than an analogy. The level where control alternates between human and agent inside a single task is uniquely bad for cognitive load, for safety and for throughput — and there is no smooth graduation from it upward, because the design decisions differ all the way through. The counterweight runs the other way too: shipping a design where code drives and the model is inserted at named points is a legitimate destination, not a failure to be agentic enough.

Where a mistake costs money rather than a red test, trust is granted narrowly and regained after every model change, data drift or shift in the environment — trust-regain cycles as a standing operational requirement. Correct output alone does not earn it. In one of the largest deployments described, roughly 30% of employees still re-asked a human after the agent answered; the residual gap was trust education, not accuracy. Published reliability evidence and visible confirmation paths close it; more capability does not.

Also: the Temporal Agent Harness (announced), a pluggable inner harness spanning several agent SDKs.

Assay sits deliberately at the level these sources describe as the useful one. Skills drive the control flow, the model fills the judgment points inside it, and promotion to the trunk is human. Desks run at the multi-PR-loop rung with a human-gated merge. The permission to ship a design where code drives and the model is inserted at named points is what makes that a principled choice rather than a compromise — the shape is described in desk roles and the lifecycle.

The warning about the mixed-initiative middle is the one place the design has to audit itself, because any point where a human and an agent share write access to a single artifact mid-task is exactly that rung. Assay’s answer is separation rather than turn-taking: a worker owns its branch and its working copy outright, the human owns the merge. Two artifacts with one owner each, never one artifact with two.

Authority is still binary — a role is trusted or it is not — where the evidence argues for authority graduated per role or per worker and keyed to accumulated evidence. Nothing yet states the condition under which a human gate may widen; the oversight-economics framing says that gate is a cost which should shrink only as demonstrated reliability accrues, and no threshold for that is written down. Detectability is where Assay is quietly strong — Verify rows, per-row evidence and closed-form invariants are all detectability investments — and the transferable proposal is a detectability line in every brief’s definition of done: how a wrong outcome would be noticed, or none, which forces a human gate. Two smaller adoptions the evidence argues for: normalizing desk reports to delivered / needed help / could not solve, and a re-verification sweep triggered by model changes, not only code changes. The 30% re-ask figure is a caution rather than a target — the human gate builds trust as well as catching faults, and removing it early would simply recreate the re-asking at the merge layer.

• Whether anyone publishes an actual threshold — the “safer than humans” number that licenses moving a class of change off human review. It is the missing quantity in every ladder here.
• Whether the practice of re-earning trust on model change spreads beyond regulated finance.
• Whether a graduated-authority scheme appears that is keyed to per-agent accumulated evidence rather than to a static role grant.