Policy
The policy layer is the part of Gevurah that is allowed to refuse. It closes by default, it refuses when it cannot verify, and it writes down the reason every single time.
The autonomy model
L3 in production, and an automatic step back the moment it matters.
Autonomy is a setting per action rather than a verdict on an agent. The useful part is not how high it goes. It is that it comes back down on its own.
The scale
Autonomy is a setting, and it should move.
Most organisations treat autonomy as a single decision. Either the agent is allowed to act or it is not, and because nobody wants to be the person who allowed it, almost everything stalls at drafting. The result is a system that produces suggestions a human then has to do anyway.
Treat it as a ladder instead, and the question stops being how much you trust the agent. It becomes which rung this specific action belongs on, which is a question with an answer.
| Level | What the system does | Where the human is |
|---|---|---|
| L0 Observe | Watches and reports. Changes nothing. | Reads the report. |
| L1 Draft | Produces the artefact and stops. | Edits and sends it. |
| L2 Prepare | Stages the action fully, ready to fire. | Approves. The action then executes itself. |
| L3 Bounded execute | Acts inside a defined boundary, and records what it did. | Reviews after the fact, and is paged on a block. |
| L4 High autonomy | Runs a whole loop, including deciding what to work on. | Sets the boundary and reads the ledger. |
Gevurah runs at L3, and some flows at L4. That is the honest description of an operating state, not an aspiration.
The mechanism
An irreversible action demotes the flow to L2 automatically.
This is the single most useful rule in the system, and it is one line to state. When a flow running at L3 or L4 reaches an action that cannot be undone, it does not ask for a judgement call about whether this particular one is safe. It drops to L2, stages the action, and waits for a person.
Three categories are irreversible by definition here: money, publishing, and any message to a customer. You cannot unsend a message, you cannot unpublish something that was already read, and a refund is a second event rather than an undo.
- The boundary is per action, not per agent. The same agent runs unattended on reversible work and stops on the irreversible step inside the same flow.
- Demotion is not a failure state. The staged action keeps its full context, so approving it is one decision rather than a re-run.
- The demotion is recorded. Which is how you find out, later, which parts of the business the system is actually allowed to touch.
Why this answers the operator's real question
The question is rarely whether an AI system can do the work. It is what happens the first time it is confidently wrong about something expensive. The answer here is structural: at the point where being wrong becomes expensive, the system is no longer the one deciding.
Observation
Most deployments are stuck at L2, and the reason is not the model.
Moving from L2 to L3 requires three things that have nothing to do with model quality: a boundary precise enough to be enforced in code, a record complete enough to reconstruct what happened, and a reliable path back down when the action turns out to be irreversible. Teams that skip straight to autonomous agents without those three end up reverting to approval on everything after the first bad week.
That is the same conclusion the industry keeps reaching from the other direction. Agentic projects rarely fail on capability. They fail on governance and traceability, which is precisely the layer that is unglamorous to build and impossible to retrofit.
Limit
The unsupervised dispatch layer has been off since 19 May. The operating mode is supervised parallelism with automatic demotion, and the numbers on this site describe that mode rather than a fully unattended one.