A rule an agent can edit is not a control.
Autonomous engineering is a governance problem before it is an engineering one. A fleet writes faster than anyone reads it. What bounds it has to be structural: enforced by grant, sorted by what cannot be undone, and checked by a seat the fleet does not outrank.
Same core as the build system, put to a different question. The build system rules on whether work is finished. This is the record of what the fleet was permitted to attempt, and who signed for the rest.
Sorted by what cannot be undone.
The axis is reversibility, never difficulty. A week of refactoring on a branch is cheaper to reverse than one grant against the production database. The refactor needs nobody. The grant needs a person.
- tier-0 Read and inspect
Reading files, running queries that only select, inspecting the running system.
Approval None required
- tier-1 Reversible by git
Editing the working tree, building, testing, committing to a branch that is not the default one.
Approval None required. Editing the agent's own instructions additionally needs a change contract, checked against the diff.
- tier-2 Irreversible
Merging to the default branch, applying migrations to the live database, granting privileges, writing the production cache, running paid compute, anything the live site then serves.
Approval A human decision, recorded in the approval ledger.
Six mechanisms, and where each one stops.
The right-hand column is the one to read. A control described without its edge is the exact defect this system exists to refuse, and a governance page that commits it has already lost the argument it came to make.
- Dispatch is gated before it runs
Every dispatch of an automated seat passes a fail-closed check first. An unpinned seat is denied. The premium verifying model is denied to every seat but the one it is reserved for, and denied to that seat once its daily budget is spent. An attempt to weaken the verifying seat is denied even when the operator asked for it.
Stops at It governs which seat runs, not what that seat then writes. The gate rules on the output.
- Scope is declared, then compared to the diff
An edit to the system's own governing instructions carries a change contract naming what it will touch. The check reads the working tree and fails on any tracked file that moved outside the declaration.
Stops at The comparison happens when the check runs, not at the moment of the edit. It proves the declaration matched the result; it does not prove the declaration came first.
- Irreversible change is separated by credential
The last tier is not enforced by instruction. The role the application and its agents connect as holds no privilege on the approval ledger. The write path takes the approver credential only: no fallback connection, no queue that drains later.
Stops at Separation binds once the agents connect as the restricted role. Under an operator credential the write still succeeds, which the migration's own negative test recorded.
- Belief is read back against the store
The system's description of what it has built is treated as a claim. A read-only probe reads what the store actually holds and reports every disagreement in both directions: claimed and absent, present and disclaimed.
Stops at The probe is on demand and off by default. With no read credential it reports absence explicitly rather than assuming agreement.
- Whoever generates, something stronger attacks
Work is matched to the cheapest seat that can do it. The seat that checks the work is never weaker than the seat that produced it, and never the same seat. Cost optimisation stops at the verifier.
Stops at Adversarial review finds defects. It does not establish correctness, and it is not the sign-off.
- The run is kept either way
Gate runs, evidence bundles, build state, drift, telemetry and approvals persist to a shared store the agents write and the operator reads. Failed runs are kept on the same terms as passing ones.
Stops at Persistence is attempted on every run and a miss is reported in that run's own output. The verdict does not depend on the write succeeding.
Whoever generates, something stronger attacks.
Separation of duties, applied to machines. Work goes to the cheapest seat that can do it. Review goes to a seat that outranks it. The cost governor runs the first half of that sentence and is not allowed near the second.
- Orchestrator
Reads the canon, designs the work, dispatches it. Never tiered down.
- Builder
Writes complex code against a tight contract and a runnable definition of done.
- Builder, mechanical
Low-freedom work with a fixed spec. One failed definition of done escalates it upward.
- Scout
Gathers evidence. Read-only, enforced by the tools it is given rather than by instruction.
- Skeptic
Attacks the others' output before anyone trusts it. Held on the strongest model available and never tiered down.
The evidence exists before anyone asks for it.
The four questions in the header are the ones an examination resolves into, whatever the letterhead. A policy document answers none of them. Here each answer falls out of doing the work: least privilege and separation of duties hold at the grant, change control emits its own evidence, and the approval record is closed to the party being approved.
Evidence toward the regimes below. Not a certification, an authorisation or an attestation under any of them, and no such claim is made anywhere on this site.
- FedRAMP authorisation of a service offering
- SOC 2 attestation report
- ISO/IEC 27001 certifiable standard
- ISO/IEC 42001 certifiable standard, AI management
- PCI DSS validated compliance
- HIPAA statutory rule
- BIPA statute, private right of action
They are not one kind of instrument and the row does not pretend otherwise. Two of them are law, with nothing to hold at the end. What they share is that answering any of them starts from the same four facts, and that a group which cannot produce those facts on the day is going to spend a quarter reconstructing them. That holds in a bank, an asset manager, a government agency, a company or a non-profit, and it holds for software written by people, by agents, or by both.
Patent pending, U.S. and international.