Class 1Nothing changes
observe
Look, and record what it saw.
Nothing outside the platform changes.
Held, not hoped for.
An agent that can act is an agent that can act wrongly. This page describes the holds: what stands over an agent before it runs, while it runs, and at the moments it must wait.
- proposed
- outbound settlement letter
- class
- commit
- verdict
- HOLD — human approval required
- stored
- the action, exactly as proposed
- approved
- by a named person
- resumed
- the stored action replayed — nothing else
Illustrative. The shape of the flow, not a live record.
The holds
Three gates, in order. Each one is cheaper than the one after it.
Before it runs
The cheapest place to stop a bad action is before the agent that would take it exists. Agent behaviour here is written as a recipe, and the recipe is examined first.
An unsafe agent recipe is blocked at compile time, before it can run.
While it runs
A cap an agent can talk its way past is not a cap, and an allowance that gives way under load is not an allowance.
Agents run under quotas and spend caps, with human approval gates on the actions that matter.
The agent’s appetite for work is not the limit; the allowance is.
When it must wait
Some actions need a person. The dangerous moment in an approval flow is not the hold — it is the resume, when the action comes back after context has moved on.
An action held for approval resumes by replaying only what was approved — nothing else.
Not a fresh plan. Not an improved draft. The stored action, or nothing.
Autonomy
Four classes of action. Graduated by what an action can touch.
Stated at capability level. An agent may hold wide freedom to observe and none at all to commit. Agents run under quotas and spend caps, with human approval gates on the actions that matter. The actions that matter sit at the commit end of this row.
Class 2A person decides
notify
Put something in front of a person.
A message, not a change of state. A person decides what happens next.
Class 3Reversible
modify
Change working state inside the platform.
Reversible while it stays internal; a later step can still intervene.
Class 4Approval gate
commit
Bind the organisation.
Money moves, a message leaves, a record becomes final. Whatever the action costs.
Underneath
The floor under the workforce. What every class stands on, whatever its freedom.
One kernel for every class
The holds above are not the agents being polite. Every action the platform governs is checked before it executes; an action that fails its checks does not execute.
Memory on every run
An agent with no memory of its last run meets every rule as if for the first time. Agents recall prior governed context on every run.
Neighbours, walled
A shared workforce platform is a security claim whether or not it is stated. We state it. Tenant isolation is enforced in the database itself and attacked by our own adversarial suite in CI.
Start here
The workflow you would not let an agent near
We will show you the holds it would run under, and the record each action would leave behind.