Autonomy is the most valuable thing you can give an agent and the most dangerous. Give too little and it saves nobody any time. Give too much and the first serious mistake ends the project — and often the appetite for agents with it.
The Citadel trust model answers the question of how much with a principle: control expands only when evidence earns it. Autonomy is designed as a graduated operating choice, not a blanket setting. This playbook explains the four levels, the evidence that moves an agent between them, who decides, and the register that keeps it honest.
The model: four levels
| Level | The agent | The person | Controls required | Evidence to move up |
|---|---|---|---|---|
| Observe | Recommends actions | Executes | Read-only access; recommendations logged next to what the person actually did | Recommendations agree with good human decisions; nothing proposed outside scope |
| Assist | Prepares the work and waits | Approves each action explicitly | Write tools behind an approval gate; requests carry evidence; decline reasons captured | Approval rate high, edits small, declines explained and falling |
| Operate | Acts within narrow policies and defined limits | Handles exceptions, reviews samples | Limits enforced outside the agent; exceptions routed; sample review; monitoring and a way to pause | Exceptions handled well, sample errors rare, boundary hits explained, outcomes at or above baseline |
| Optimize | Proven workflows expand through measured, reviewed changes | Approves each change | A change process; re-evaluation on every change; regression suite | Sustained results through changes; each expansion evaluated before it takes effect |
Each step up gives the agent one thing it did not have — execution, then independence within limits, then wider scope — and each needs evidence from the level below. Assist depends on well-designed approvals; Field Guide 014 covers the patterns.
Three rules
1. Autonomy belongs to an action, not to an agent
The same agent can Operate on order-status replies, Assist on refunds, and only Observe on anything involving a contract. Grant autonomy per workflow and per action type. An agent described simply as "autonomous" has not been governed; it has been trusted.
2. Moving up is a decision a person makes, on evidence
Promotion is never automatic and never a setting someone changes because a demo went well. It is a recorded decision: the evidence considered, the person who decided, the date, and the new limits. In the Guild, Oracle scores the evidence, Sentinel checks that the boundaries held, Athena owns the approval points, and a Human Wizard makes the decision.
3. Moving down is normal, and fast
A step down is not a punishment; it is how the model stays safe while things change. It should take one action, by the owner, without a meeting.
Earning a promotion
Write the criteria before the period starts, so the evidence is judged against a standard rather than a mood.
- Volume — enough cases at the current level to judge, including the uncommon ones, not only the easy ones.
- Time — long enough at the level to include the busy days, month-end, and the unusual.
- Thresholds — the measures that matter for this action are at or above the levels set in advance.
- Must-pass record — no policy, permission or approval failures during the period.
- Edge cases — the escalation cases have occurred and were handled correctly; if they have not occurred, they have been tested.
- Re-evaluation — the full scenario suite has been re-run at the proposed scope and limits.
- Owner agreement — the operating owner accepts the new level and the new risks.
If the criteria are met, the person deciding records the promotion. If they are not, the record says what is missing.
What to measure at each level
The evidence differs by level, because the question differs.
- At Observe — agreement. How often the agent's recommendation matches what a competent person decided, and, in the disagreements, who was right. Disagreements in which the agent was right are as informative as the ones in which it was wrong.
- At Assist — approval health. The share of work approved unchanged, the size of the edits, the reasons for declines, and how long requests wait. Long waits are a design problem, not an agent problem.
- At Operate — outcomes and exceptions. Task success against the baseline, exception rate, human intervention rate, errors found in sample reviews, boundary hits, cost per mission.
- At Optimize — stability through change. Regression results after every change, and whether outcomes hold as scope grows.
In the Guild's Evaluation Lab, Oracle owns these measures. They come from the same scorecard used before launch, so the evidence before and after go-live can be compared directly — and a promotion can be argued from numbers rather than impressions.
Triggers for stepping down
Step an agent down — at least for the affected actions — when any of these happens:
- an incident, or a must-pass failure in production;
- a change of model, instructions, tool or knowledge source, until the suite has been re-run;
- drift: the measures move away from their levels at promotion;
- the business changes — a new policy, product, market or regulation;
- a pattern of boundary hits that nobody can explain.
Return to the previous level when the cause is understood and the evidence is back. That is also a recorded decision.
What changes in the Citadel at each level
The level is not a label on a slide; it is configuration that people can see.
- Approvals — at Assist, every action of that type waits in the approval queue. At Operate, only exceptions and actions above limits arrive there.
- Agent Console — shows which agents are active and whether they are within policy, so the current level and its limits sit on the agent's record.
- Activity Ledger — records what changed, who acted and on what evidence, including every promotion and step-down.
When someone asks why an agent was allowed to act alone, the answer is a link, not a recollection. The Citadel page shows the modules involved.
The autonomy register
Something concrete for the next working session: one row per agent action.
| Workflow / action | Current level | Since | Limits | Evidence for this level | Promotion criteria | Next review | Owner | Approved by |
|---|---|---|---|---|---|---|---|---|
Review it at a fixed rhythm with the operating owner. A row with no evidence, no owner or no review date is the first thing to fix.
Example
Illustrative example, not a client engagement.
An accounts team uses an agent to chase overdue invoices.
- Observe. Each morning the agent lists which invoices to chase and drafts the reminder; a person decides and sends. After several weeks its lists match what the team would have chosen, and its drafts need little editing.
- Assist. The agent prepares the reminders in the email tool; a person approves each one. Edits shrink; the declines that remain are about customers in an active dispute — so disputes become an escalation rule.
- Operate. The agent sends first and second reminders on its own within approved templates and a daily cap. Third reminders, disputed invoices and key accounts go to a person. A sample is reviewed every week.
- Step down. The finance system changes its invoice export. Until the scenario suite has been re-run against the new format, sending returns to Assist. One action by the owner; recorded.
- Optimize. With a steady record, the owner approves a measured change: adjusting reminder timing by customer segment, evaluated before it takes effect.
Failure modes
Failure pattern — Promotion by enthusiasm. A good week, a convincing demo, a busy team — and the agent moves up without the criteria being met. Write the criteria first.
- One level per agent. The risky actions inherit the autonomy earned by the safe ones.
- No way back. Stepping down needs a project, so nobody does it.
- Volume without variety. Hundreds of easy cases, none of the hard ones, read as a strong record.
- Silent drift at Operate. Nobody reviews samples because nothing has gone wrong yet.
Checklist
- Autonomy is recorded per workflow and per action, not per agent.
- Every new agent starts at Observe or Assist.
- Promotion criteria are written before the evaluation period.
- Every promotion and step-down is recorded with evidence and a name.
- Step-down triggers are defined, and stepping down takes one action.
- Changes of model, instructions, tools or knowledge trigger a re-run.
- Operate-level actions have limits enforced outside the agent and a sample review.
- The autonomy register has an owner and a review date for every row.
