Graduated autonomy: delegate by blast radius, keep binding decisions human

Decision records, five of ten. One architecture decision per piece, from a governed AI-agent platform I designed and built as a prototype for Dutch local government.

The situation

Building the platform, I used AI pipelines to produce much of the design work: candidate decisions, draft records, proposed changes to the component model. They were good at it, and that was the problem. They produced decision candidates faster than the accountable human could read them, let alone ratify them. Decision latency, not generation, became the scarce resource.

The obvious fix is to let the pipeline approve its own output. Two principles I had already committed to forbade that. A critic may not approve its own work. A model may not be the sole approver of anything with consequences. Those are not arbitrary; they are the same principles the platform enforces for the agents it runs, and a build process that ignores them for convenience has no standing to enforce them on anyone else.

So the question was not “human or machine”. It was: which decisions can be delegated, on what basis, and how does a human stay accountable without being the bottleneck for everything?

The decision

Four classes, ordered by blast radius.

Class 0 is mechanical upkeep: formatting, index regeneration, renumbering. Autonomous. If it goes wrong, a diff shows it and a revert fixes it.

Class 1 is evidence verdicts: does this claim have a source, does this test pass, does this record match its schema. Autonomous, because an external source is the oracle. The pipeline is not judging; it is checking against something outside itself. And the marks it produces are append-only, so a wrong verdict sits visibly next to the right one rather than replacing it.

Class 2 is non-binding drafts: proposed decision text, proposed amendments, proposed structure. Autonomous with role concurrence, meaning more than one pipeline role has to agree before the draft is filed. A next-run audit re-reads every Class 2 output. Collisions, where two drafts contradict each other, are reported and never resolved by the pipeline. A human resolves them.

Class 3 is binding: anything with a number in it, anything with legal effect, anything that changes the delegation rules themselves. Human-only. Explicit consent, no deadline, and silence means not yet decided. A Class 3 item that nobody has answered is open, not approved.

Later I amended this. Reversible internal “how” decisions, choices about structure and method that could be undone without external effect, moved to an AI council under audit: several model roles with different briefs that have to concur. Numbers, legal effect and the delegation rules themselves stayed human.

Silence means “not yet decided”. In most organisations silence means “approved”, which is how most organisations end up approving things nobody remembers deciding.

What I rejected, and why

Full delegation. If the pipeline could mark its own decisions accepted, then “accepted” would mean only that the machinery did not object. That is not a decision, it is an absence of error messages, and it is exactly what a critic approving its own work looks like.

Consent by deadline. Propose, wait a week, treat silence as yes. This is how a lot of organisations actually work and it is a rubber stamp with a calendar attached. The timeout does not know whether the human was thinking or on holiday.

Status quo. Everything human-ratified. That is where I started and the latency made it unworkable. A governance scheme that produces a queue nobody can clear is not governance; it is a backlog with a conscience.

What it costs

A classification step on every output: someone, or something, has to say which class a candidate belongs to, and the classifier itself is a Class 2 draft subject to audit. Role concurrence multiplies the model calls for Class 2 work. The next-run audit means every run spends part of its budget re-reading the last one.

And there is an honest risk I want to name rather than bury. The council produces Class 2 work and the council also endorses it. Those are different roles with different briefs, but they share the same underlying models, and they can share blind spots with their auditor. Role concurrence protects against a single role’s error. It does not protect against an error every role makes the same way.

What it does not do

It does not make the drafts good. It makes them traceable and reversible. Quality still comes from the briefs and from the human reading the output.

And a note on where this ended up. The pipeline this scheme governed was later paused, in favour of putting the time into working software. The classes and the principles behind them carried over into the platform’s own approval model. The pipeline itself did not survive contact with the question of what was actually worth building.

If you take one thing

Take the last ten decisions an automated process made in your organisation and sort them into three piles: reversible with no external effect, checkable against an external source, and binding. If anything in the third pile was approved by a timeout, that is the one to pull back first.

And now for something completely different: a decision process in which silence is not consent.

References

The allusions and quotations in this piece, with their origin:

• Monty Python’s Flying Circus: “And now for something completely different”, John Cleese’s link line.