Governance
framework.

Every decision the system emits declares its class. The banned phrase “fully automated” is not expressible in the schema — there is no field for it.

Class AInformational — 20.47%

Reads, retrieves, restates a verified fact. Decides nothing. The Knowledge Spine lives here: it halts rather than guess.

Class BAdvisory — 18.94%

Prepares a recommendation for a human to accept or reject. Credited at 0.55, never as full autonomy. A Class C decision that fails one precondition falls back to here.

Class CControlled automation — 43.81%

The only class an agent may finalise on its own — and only when all seven preconditions hold simultaneously. The bulk of the delegable work.

Class DRestricted — 12.85%

The agent may prepare the whole package but a named human finalises. Discretionary or high-value determinations sit here regardless of confidence.

Class EProhibited — 3.92%

No autonomous action, ever. An agent may not even approve its own exception. This 3.92% is the floor that fixes the hard ceiling at 96.08%.

Classes A + C (fully delegable) = 64.28%. Classes D + E (human-reserved by rule) = 16.77%. The mix, not the model’s ability, is what sets the ceiling.

An agent never decides its own class. It declares a candidate and an independent gate adjudicates. Class C requires all seven of these to hold at once — six of seven is a Class B outcome, not a Class C approval with a caveat.

01Inputs complete

Every field the decision depends on is present — nothing inferred to fill a gap.

02Rules deterministic

The governing rule resolves to one answer, not a judgement call.

03No exception detected

The case matches no exception, conflict or edge condition.

04Confidence above threshold

The agent's own confidence clears the declared bar (0.85 by default).

05Within delegated authority

The action falls inside the mandate this agent was granted — no reaching.

06Evidence auto-stored

The decision writes its own provenance to the hash-chained log as it is made.

07Reversal possible

The action can be undone if later found wrong. Irreversibility alone forces a human.

Degrade to advisory, never to silence

An agent that fails its health check drops from Class C to Class B — it keeps advising while a human absorbs the load. A pipeline may never stall because one component is unwell.

No self-approval

Assurance (P6) may never approve a proposal it generated itself. High-risk decisions require proposer/approver separation — two independent agents, or an agent and a human.

No invented facts

No agent may invent a missing approval, requirement, measurement, evidence item or authority decision. A missing fact halts the branch; it is never papered over.

Confidence and risk are ANDed

Confidence never buys down risk. A 99.9%-confident life-safety determination is still Class D. Any confidence at critical risk requires human authority.

Every element declares a continuity mode

Nothing is complete until it names its degraded mode, manual fallback, recovery objectives and crisis authority. An undeclared continuity mode is an incomplete design, not merely an undocumented one.

When two rules disagree, precedence is explicit and encoded — it is never left to whichever agent happens to run first.

A statutory instrument or an affection-plan figure always overrides the Frozen Design Language. The design engine narrows within a statutory envelope; it can never originate or contradict one.Design language →