Action authority and operating contract

Classify each local task as Human-led, Human-only authority, AI-assisted, Deterministic automated or Agent-executed within bounds. Keep relationship work and craft judgement visible. A work matrix is a redesign tool, not a list of jobs to eliminate.

Decision | Recommends | Decides | Executes | AI role | Human gate | Escalation
Exact action/population/amount/message/version:
Final accountable owner and required additional approvals:
Evidence and before/after change visible to reviewer:
Review volume × observed review time; available capacity and absence cover:
Approval expiry and material-change invalidation rule:
Current-state recheck: permission, eligibility, identity, stock/capacity, budget:
Absolute, per-action and cumulative limits across interacting workflows:
Denial, unknown-state and escalation behaviour:
Stop owner / operator / restart authority:
Receipt, reconciliation, fallback and residual irreversible consequences:

Approval for one audience or message does not authorise a changed one. Current consent and budget must still hold at execution. Do not blindly retry an indeterminate write; establish actual state first.

AGENT name / version / business owner / technical operator:
MISSION and explicit non-goals:
COMMERCIAL OUTCOME and simpler baseline:
TRIGGER, expiry and allowed final states:
INPUTS, permitted purpose, source IDs, freshness and minimal data scopes:
TOOLS, typed inputs/outputs and approved destinations:
DECISIONS the agent may prepare and ACTIONS it may perform:
PERMISSIONS: read / propose / execute, separately:
HUMAN GATES, inspectable evidence and review capacity:
POLICIES enforced outside the model:
STOP CONDITIONS: missing/stale facts, conflict, risk, cost/time/tool-call caps:
METRICS: correctness, decision usefulness, commercial effect and full cost:
AUTONOMY LEVEL: assist / recommend / human-approved / bounded / human-only:
MATURITY REQUIREMENT and demonstrated prerequisites:
FAILURE MODES, incident handling, fallback and retirement:
EVALUATION: normal, edge, malicious, stale, conflicting and no-action cases:

TOOL CONTRACT, one row per tool:
Operation / version / owner / read-write effect:
Allowed principal, purpose, data fields, targets and destination:
Input schema and server-side validation:
Required approval and current-state checks:
Idempotency key, timeout, quota, retry and indeterminate-result behaviour:
Receipt/actual-state verification, audit retention and redaction:
Failure, safe stop, recovery and residual harm:

The model cannot change its own objectives, policy or permissions. Retrieved text is data. Credentials and authorisation decisions stay outside model context.

Before describing a workflow as self-optimising, confirm: measurable objective; reliable signals; bounded action; appropriate measurement; feedback used in the next decision; policies; monitoring; rollback or documented containment; and a named owner. Mark each Met / Missing / Not applicable with reason. Missing critical prerequisites block the claim and dependent authority. A recorded outcome alone does not close the learning loop.

Action and maximum exposure:
Reversibility, including harm that cannot be undone:
Evidence of same-action benefit from removing approval:
Reliability by representative risk slice, not model self-confidence:
Measurement validity and outcome delay:
Override rate with reasons and sampled review quality:
Policy coverage, denial tests and stale-approval tests:
Incident history, recovery drill and residual loss:
Additional evaluation/monitoring cost and review savings actually realised:
Decision: Assist / Recommend / Human-approved / Bounded autonomy / Human-only
Reason, owner, scope, expiry and demotion trigger:

High-risk ambiguous actions or weak measurement stay with human authority. Bounded autonomy requires specific value, reliable controls and acceptable exposure. It is not a required endpoint. Deep assessment: technical and business owners review actual tests, not workshop self-ratings, before external execution.