An agent that can act is only useful if the business can trust what it does. That trust is not a property of the model — it is a property of the system around the model. This paper sets out the pattern we use to give agents genuine autonomy while keeping a human accountable for every consequential action: approval lanes, reversible actions and a complete audit trail.
1. The control problem
Autonomy and safety are usually treated as a trade-off: the more an agent can do on its own, the less oversight there is. That framing is wrong. The real variable is not how much an agent does, but which actions are allowed to happen without a human in the loop, and how visible every action is after the fact.
A useful agent touches real systems — it sends messages, moves money, changes records. The question a business actually asks is simple: if this goes wrong, will I know, and can I undo it? Everything below is an answer to that question.
2. Approval lanes
We classify every action an agent can take into one of three lanes, by blast radius — not by how "smart" the step is.
| Lane | Meaning | Human involvement |
|---|---|---|
| Green | Reversible, low-consequence (draft a reply, tag a record, propose a plan) | None — the agent acts, and it's logged |
| Amber | Consequential but recoverable (send an email, issue a refund under a threshold) | Notify + allow undo within a window |
| Red | Irreversible or high-value (delete data, pay above a threshold, sign) | Explicit human approval before it happens |
The lane is a property of the action type and its parameters, decided by deterministic rules, not by the model's confidence. A model that is confidently wrong must still not be able to cross a red line on its own.
3. Reversibility as a first-class design goal
The cheapest form of safety is an undo button. Wherever an action can be made reversible, we make it reversible and move it to a lower lane — a held send, a soft delete, a staged change that commits after a delay. Reversibility turns an approval gate into a notification, which keeps the operation fast without giving up control.
4. The audit trail
Every action — proposed, approved, taken, reversed — is recorded as an immutable event: what the agent did, the inputs it saw, the rule that set the lane, who approved it, and the outcome. The trail is not a log file; it is the primary interface for trust. It answers "what happened and why" for any single action, and it is where the system's behaviour is reviewed and improved.
5. Why this makes agents more autonomous, not less
Counter-intuitively, strict lanes increase how much you let an agent do. Once every consequential action is either reversible or gated, and every action is on the record, there is no reason to keep the agent on a short leash for the reversible majority of its work. Governance is what lets you safely widen autonomy — the audit trail is what makes each exception a lesson that tightens the rules over time.
Trust is not the absence of oversight. It is oversight made cheap enough to always be on.