Decision 0009
Five autonomy levels; reversibility is computed and is the boundary
Architecture decision record 0009: Five autonomy levels; reversibility is computed and is the boundary
Context
“The agent has full control over itself” must be true by design and safe by default. The review’s
strongest objection to the first draft was that reversibility was asserted: enabling sshd,
adding a user or opening a port are covered by generation rollback and irreversible in effect.
The three plans
- Grok (Q-12): propose only, apply after confirm, or autonomous inside a declared playground.
- Fable: capability grants
auto | ask | denyper category; every action a diff; undo. - Codex: levels 0–4 (Explain, Ask, Trusted workspace, Policy autonomy, YOLO); Ask by default; YOLO explicit with a persistent indicator and hard boundaries.
Decision
| Level | Name | Behaviour |
|---|---|---|
| 0 | observe | read-only |
| 1 | consult | proposes everything, asks for everything |
| 2 | reversible (default) | acts with notification when the classifier proves reversibility; asks otherwise |
| 3 | trusted | also acts on owner-declared categories |
| 4 | sovereign | everything except hard invariants; persistent indicator; expires at reboot or after a window; never entered silently |
Reversibility is computed by the keeper over the rendered option diff. Unknown is irreversible.
The explicit irreversible list: exposure, principals, secrets, boot and encryption, external
devices, data deletion, git push, egress of file content. Taint: a turn whose context contains
untrusted content is capped at level 1 for side effects; voice-origin intents are capped at level 2
unless confirmed on a physical input. Budgets per session (transactions per hour, closure delta,
egress bytes, spend) downgrade to level 1 when exceeded. Tool visibility is scoped per session.
The default is level 2 because an agent that must ask before every reversible change is a chatbot with a confirm button, not an operating system; it is safe because the classifier, taint, budgets and the immune system (ADR-0013) ship in Phase 1 before any model is trusted.
Consequences
- Codex’s “YOLO” becomes
sovereignwith an expiry. - Fable’s capability grants survive as level-3 declarations and per-category
auto | ask | deny. - The classifier needs tests before the agent loop does.
Alternatives rejected
- Ask by default: contradicts the manifesto and trains owners to approve blindly.
- Privilege as the boundary: root is the wrong axis; a user-level
rm -rf ~is irreversible.