Authority that exceeds available evidence is a possible AI failure mode, alongside model quality, access, usability and operations. The ladder makes authority an explicit decision; it is not a measured explanation of all failed programs.
Rung one — AI-assisted
The human does the job; the model removes the blank page, the lookup and the reformatting. Nothing is committed without a person. Risk, effort and value depend on the workflow. Evaluate usefulness, review burden and failure handling before adoption.
Rung two — AI-enabled
The system drafts, routes, classifies or scores, and a person approves. Define authority boundaries and proportionate evidence for versions and approvers, excluding sensitive content where needed. Suitability depends on the workflow and its review requirements.
Rung three — agent-run
The agent executes a defined job autonomously within explicit limits, with monitoring, evidence and a rollback path. Reserved for work where the acceptance test is objective and the blast radius of a bad run is bounded and reversible.
The five questions
- What may this agent act on, expressed as data boundaries rather than intentions?
- What must it escalate instead of deciding?
- What purpose-limited evidence is needed, who may access it and what retention period is agreed?
- How is it evaluated, on what fixed set, and on what trigger?
- How is a bad run detected, and what is the exact procedure to undo it?
If any of the five has no answer, the workflow stays a rung lower until it does. This is not caution for its own sake — it is the only version of the system you can defend when something goes wrong in front of a customer.
Moving up
Promotion between rungs should be evidence-driven: run the enabled version long enough to accumulate a labelled record of human approvals and corrections, then use that record as the acceptance set for autonomy. Reuse of approval evidence for evaluation or training needs its own purpose, permission, minimisation and retention review.
Agent authority is an architecture problem, not a prompt problem.
Further reading
Primary references for relevant design principles, not evidence of DeftSpan deployment, certification or measured outcomes. Read these in context: general safety guidance cannot remove all risks, and privacy-risk guidance is not certification.