An open standard
Earned Autonomy: Principles for autonomous agents that touch production
Autonomous software is moving from advice to action. Autonomy isn't a binary switch granted at install. It is earned level by level. As an agent proves accuracy and stays within customer-defined guardrails, it graduates across four distinct operating tiers (L0 to L3), moving from passive diagnosis to policy-governed execution.
Write access is earned through proven accuracy, human gates, and strictly bounded blast radiuses, published openly for the industry to engage with, improve, and adopt.
Why this exists
A shared, industry-wide safety problem
The autonomy frontier is moving quickly, and recent events have made the stakes concrete. Agents that escalate their own access, reach systems they were never scoped to, and act without explicit guardrails are no longer hypothetical. This is a category problem, not any single vendor's issue, and it deserves a shared architectural answer.
The choice in enterprise AI shouldn't be between passive dashboards (read-only) and unconstrained agents that breach boundaries. Autonomy isn't an all-or-nothing switch granted at install. It is earned through policy, proven accuracy, and strictly bounded blast radiuses.
The principles below are the design constraints we hold ourselves to before The Production Ops Agent is ever allowed to change a production system. They contain this class of failure by design and give operators a concrete bar to hold every autonomous vendor to, including us.
The Earned Write Access spectrum
How agents graduate from supervision to autonomy
Instead of forcing a choice between manual approvals and blind auto-pilot, Earned Write Access defines a dynamic trust spectrum. An agent begins by diagnosing issues and proposing remedies, graduating to policy-bounded autonomy only as trust, accuracy, and guardrails are established.
How much handshake?
Zero write access. The agent looks, listens, and drafts the playbook.
How it actually works
Tracks down root cause, writes the exact fix or CLI command, and hands it over. It cannot execute a thing on its own.
Where you use it
Day one on the job. Onboarding and stack discovery.
How much handshake?
Zero write access. The agent looks, listens, and drafts the playbook.
How it actually works
Tracks down root cause, writes the exact fix or CLI command, and hands it over. It cannot execute a thing on its own.
Where you use it
Day one on the job. Onboarding and stack discovery.
How an action graduates
Promotion across levels requires demonstrated RCA accuracy (>94%), bounded blast-radius isolation inside your VPC, and deterministic automated rollbacks if health metrics drift.
Principle 03 in Practice: The L1 Approval Boundary
Every state-changing action stops for a human
Before an agent graduates to L2 policy execution, every state-changing action halts at L1. The agent surfaces the exact CLI command, target scope, and blast radius, waiting for human authorization before touching production.
Now previewing: L0 · Read & Recommend
Recommendation only. At L0 the agent diagnoses and drafts the fix, but it holds zero write access.
Root cause identified. Proposed runbook to deploy the Run Club to production, ready for a human to review and run.
cd /vercel/share/v0-project && gh pr merge 111 --merge 2>&1 && echo "=== verify ===" && gh pr view 111 --json state,mergedAtThe four core principles
What responsible autonomous production ops looks like
Containment inside the customer boundary
Whether operating at L0 (read-only) or L3 (earned autonomy), the agent runs entirely inside your environment and never leaves the customer boundary. It cannot reach the open internet on its own and cannot access systems you haven’t explicitly granted scope to.
- VPC ExecutionRuns entirely within your VPC at every level of autonomy.
- Zero Internet BreakoutNo self-directed access to external systems.
- Zero Data StorageOperational data stays inside your environment, backed by SOC 2 Type II.
Bounded & explicit write scope
Write access is never assumed or global. Before an agent can cross from L0 (Read & Recommend) into L1 (Human-Gated action), every write operation is explicitly scoped to a specific runbook, system intent, and blast radius.
- Scoped IntentWrite permissions are granted per service, never as global root control.
- Blast-Radius IsolationAction boundaries prevent cascading cross-system failures.
- L0 Propose-First StanceAlways defaults to diagnosis and recommendation before write access is requested.
Policy-gated autonomy & boundary approval
No state-changing action happens outside human-defined rules. At L1, every command stops at the boundary for explicit 1-click human sign-off. At L2 and L3, routine remedies execute automatically within pre-approved policy parameters, but the agent can never self-escalate its permissions.
- L1 Boundary GateEvery state-changing action surfaces intent, command, and blast radius for human approval.
- L2/L3 Dynamic EngineDictates when an action requires human sign-off vs. automated policy execution.
- Automated Safety BreakersInstant auto-rollback if post-remediation metrics drift.
Full, immutable audit trail
Every diagnosis at L0, human approval at L1, and policy execution at L2/L3 is recorded in real time. Anyone can reconstruct exactly what the agent did, why it acted, and whether a human or policy authorized it.
- Complete System HistoryFull logging of diagnoses, human approvals, policy evaluations, and executions.
- Level AttributionEvery state change is tied directly to an approving human (L1) or an explicit policy rule (L2/L3).
- Compliance Ready100% reconstructable after the fact for post-mortems and security audits.
Proof points & deployment reality
Measured across live enterprise deployments
The spectrum over time
Trust shifts rightward as it is proven
Share of actions executed automatically vs. human-gated, across customer tenure. As accuracy and guardrails are proven, more actions graduate toward autonomy.
An open invitation
Hold every autonomous vendor to this bar
This document is open. If you build, buy, or operate autonomous software that can touch production, we invite you to adopt these principles, pressure-test them, and help sharpen them. The goal is a shared reference the whole industry can point to, not a single vendor's marketing.
We are gathering named co-signers from operators, security leaders, and independent voices. If you want to add your name or propose a revision, reach out.
How we apply it
The commitment, in four lines
- 1The agent operates inside the customer boundary and stores no data.
- 2Write access is earned and bounded, never assumed or open-ended.
- 3Every state-changing action is approved by a human at the boundary.
- 4Every proposal, approval, and action is recorded in a full audit trail.
See it in practice
Autonomy you can actually trust
See how The Production Ops Agent applies earned write access to real incidents, inside your environment, with a human on every action.