The Delegation Quadrant.

Ask what autonomy level an AI agent has, and the answer is usually one number for the whole system. That number is almost useless.

The same agent may read a document, draft a summary, update a staging record, send an email, change production permissions, and initiate a payment. Those actions do not become equally risky because they share a model, an interface, or a workflow. Reading a document and sending money are different governance problems even when one system performs both within the same minute.

Oversight designs miss that in one of two directions: route everything through a person, spending scarce attention on work that is cheap to reverse, or grant a blanket autonomy level that leaves consequential actions with the controls of routine ones. Gate everything and gate nothing look opposed. They are the same mistake at different settings — assigning oversight to the system instead of to the action.

The Delegation Quadrant changes the unit of analysis. Inventory every externally meaningful action the system can take, classify each along 2 dimensions — reversibility and blast radius — then set a minimum oversight posture. The grid is not a complete model of risk. It is the first classification a design must survive before anyone can claim anything about autonomy.

The unit of governance is the action

“The agent handles client onboarding” is not an action inventory. It is a product description.

An action is an externally meaningful read, write, send, execute, delete, approve, or transfer — it changes what a person can see, what a system records, or what the outside world experiences. Model tokens and hidden reasoning steps matter for evaluation, but they are not the units to which operational authority is granted.

Consider an illustrative onboarding workflow, with the classification each step assumes:

1. Read submitted identity documents — Class I, if access is authorized and the read crosses no protected-data boundary.
2. Extract fields and draft an internal summary — Class I, while the output stays internal.
3. Write proposed values to a staging record — Class I where downstream use is blocked; Class II if the staging write fans out.
4. Send a request for missing information to the client — Class III when the message reaches one client; Class IV if it goes out broadly.
5. Update production permissions across several systems — Class II if reliably reversible and broad; Class IV if exercised access creates durable disclosure.
6. Initiate a financial transaction — Class IV where irreversible and broad in reach.

The verb does not settle the class. The object does, along with the boundary crossed, whether downstream use is blocked, and how far the effect reaches — which is why an inventory names the implementation, not the API.

Given those assumptions, one agent runs at A4 for the read, A3 for the draft and staging write, A2 for the permissions change, A1 for the client message, and A0 for the payment, which stays with a person. The tiers run A0 advisory through A5 delegated, with A1 gated, A2 exception-gated, A3 sampled, and A4 monitored between. Six actions, five answers, one product.

Volume is the variable teams reach for instead, and it inverts the result. Take a workflow where a payment runs once a day and a draft-email action runs two hundred times: gate by frequency and the drafts attract the friction, because someone noticed the number, while the payment passes on light review because nothing was built around it. Consequence, not count, has to do the sorting.

Two axes, asked about the same action

The first axis asks whether an action can be undone while undoing it still matters.

Technical rollback does not settle it: a production write may be reversible in the database and irreversible in the operation, because downstream systems have acted, a client has seen the change, a deadline has passed. Restoring yesterday's table does not retract today's decision. Reversibility therefore includes at least 4 facts — time to detection, time to recovery, downstream propagation, and the cost of making affected parties whole. An organization that cannot say how it would detect and reverse an incorrect action before harm becomes durable does not get the benefit of the label.

The idea has clear prior art. Jeff Bezos set out Type 1 decisions — consequential and hard to reverse — against Type 2 decisions that are changeable, in his 2015 letter to shareholders; the same framing travels as Amazon's “one-way” and “two-way doors,” and AWS's architectural guidance recommends centralizing the irreversible and distributing the reversible.

The second axis is borrowed too. Bounding scope of impact is established reliability and security practice — AWS documents fault isolation boundaries so workloads can rely on “predictable scope of impact containment,” and segmentation does the same work in security architecture. “Blast radius” is the informal name for the property those disciplines engineer. It asks: if one action is wrong, how much can it touch before the system or a person contains it? “Contained” does not mean harmless — it means the effect is bounded to one case, one record, one customer. “Broad” means one action reaches many records, accounts, people, or systems before the error is found.

Neither axis answers the other's question, which is why collapsing them into a generic “risk score” discards the reason the controls differ. A bulk permissions update may be reversible and still broad; an email to one client may be irreversible and contained. They are not independent, though — coupling moves both, and enough propagation turns a reversible change into an irreversible one.

One input is routinely left out. Blast radius is usually scoped to an action that is wrong. For a system holding credentials and tool access, the sharper question is what happens when one is induced — by prompt injection, a poisoned retrieval source, a compromised document. That does not enlarge the triggering read into everything the system could do; the read remains its own action. It means the induced follow-on actions — the writes, sends, executes, and transfers a compromised input could reach — are actions in their own right, each inventoried and classified on its own terms. Credential scope, tool allowlists, and egress rules are the authority envelope deciding which are reachable at all: blast-radius modifiers and structural constraints, chosen at design time, not at the gate.

Four classes, four minimum postures

The axes produce 4 action risk classes. The posture in each cell is a floor. Applicable law, contractual obligations, rights impacts, uncertainty, verification cost, or the institution's risk appetite may require stricter treatment.

Those postures name control types, and the type matters as much as the presence. A tool allowlist is structural — it changes what the systemcan do. A threshold check is runtime-preventive, an eval detective, a rollback corrective, a review board procedural, a provenance trace documentary. Class I leans detective and documentary; Class IV needs structural and runtime-preventive controls, because procedure alone is an instruction, and instructions are not enforcement. A program whose weight sits entirely in the procedural and documentary columns has written down its intentions, not built its controls.

Class I is where organizations should be willing to learn: approving every instance costs more attention than the action warrants. Class II needs engineering even though the action reverses — broad scope makes recovery an operational event, not a button, so rollback must be demonstrated and monitoring must catch failure before propagation. Class III is narrow but durable: a client communication or deleted record may affect one case while remaining impossible to retrieve. Class IV carries both problems — a wrong action persists and travels. The mechanism comes from the domain; the quadrant establishes that a vendor default or an outcome-only dashboard is not enough.

One composition rule sits underneath the table. These bands are risk-only: they assume verification is not the binding constraint. Where it is, the tighter rule governs, and an action whose correctness requires full expert review does not earn the top of its band however contained it is. A Class I action at verification cost class V3 gets A2, not A3–A5. Risk class sets the band and the control floor; verification cost can pull the allowable ceiling below it.

A human step is a control only when attention can still do work

The control patterns are older than generative AI, and so is the failure mode.

NIST SP 800-53 Rev. 5 defines dual authorization at AC-3(2): “Enforce dual authorization for [Assignment: organization-defined privileged commands and/or other organization-defined actions],” which its discussion describes as two-person control. FFIEC guidance requires, under its privileged user controls, that more than one privileged user at a financial institution approve access to certain critical systems or administrative changes — and separately describes dual-control transaction capabilities institutions offer business customers. Neither says every irreversible, broad AI action needs the same checker design. They establish the discipline: consequential authority can be separated, scoped, and assigned to more than one actor.

That prevents a shallow analogy. An AI system is not simply “the maker,” and a person clicking approve is not automatically an effective “checker.” Independence, information quality, competence, time, and real authority decide whether the second step is a control or a signature ceremony. The EU AI Act makes the point from another direction: for covered high-risk systems, Article 14 requires effective human oversight and names the capabilities it depends on — understanding limitations, detecting anomalies, avoiding over-reliance, interpreting outputs, overriding or reversing them, interrupting operation — and recital 73 adds that the assigned people must have “the necessary competence, training and authority to carry out that role.” NIST's AI Risk Management Framework treats human roles as contextual components of risk management. None of these prescribes or endorses this quadrant; the framework here is not a standard.

Whether attention survives the queue is empirical, and the evidence is setting-specific. Ancker and colleagues, studying clinical decision support in an outpatient EHR deployment, report that a clinician's likelihood of accepting a reminder fell roughly 30% per additional reminder in the same encounter and 10% per five-percentage-point rise in repeated reminders — driven by work complexity and repetition, with no independent effect of workload itself. Agudo and colleagues found incorrect algorithmic support degraded accuracy, particularly when the advice arrived before the person formed a judgment. In a process-control simulation, Wickens and colleagues found automation that was wrong on its first failure hurt performance more than automation that simply missed the event.

None of that is a law. Nothing here establishes a universal approval-fatigue threshold, and an agent-approval queue is not a clinical reminder. What it establishes is narrower and sufficient: “a human reviewed it” does not describe control efficacy, and review volume is a variable to instrument rather than assume.

Action-level classification protects both sides. Reversible, low-consequence work does not consume pre-approval capacity; consequential actions arrive at a narrower gate where a person has a fighting chance. Then measure whether the gate works — intervention rate, decision time, disagreement rate, escaped-error rate, and how often the reviewer sought more evidence. The taxonomy names the failure this prevents: nominal in-loop, a human formally in the loop who, once approval volume outruns the attention available, is functionally reviewing outcomes while carrying in-loop accountability. A near-zero intervention rate does not prove a gate has reached that state, but it is a prompt to check whether review still discriminates. Efficacy is tested, not inferred from an approval record. The objective is not fewer humans; it is judgment placed where judgment changes outcomes.

The disagreement is the deliverable

Building the grid looks simple once the classifications are settled. Settling them is the work.

Engineering may call a write reversible because the database supports rollback. Operations may know that 3 downstream teams act on the value within an hour. Risk may identify a disclosure consequence neither modeled. The argument is not friction to remove — it is latent architecture becoming visible before an incident. So the workshop starts from the complete action inventory with engineering, operations, risk, and the accountable owner in the room. Each action gets a provisional classification, its evidence, the chosen minimum posture, and the person who owns reconsideration. Disagreement is recorded and resolved rather than averaged into a score.

Classification also expires. Recovery mechanisms improve, integrations add downstream effects, scope grows; evidence earns a higher tier, or an incident moves it down. A quadrant assignment is a versioned control decision, not a permanent property of the action. This is why the framework sits inside a trust gradient — trust granted per action class and earned per track record, never granted to a system whole. Reliability on document extraction does not grant authority to send payments.

The strongest objection is that 2 axes cannot capture real risk

They cannot.

Reversibility and blast radius are contested spectra presented as a clean grid. Detection time can change reversibility; coupling can change blast radius. A contained action can violate a person's rights. A reversible action can disclose information no rollback makes secret again. Model uncertainty, verification cost, adversarial exposure, and jurisdictional rules all matter. A 2×2 can manufacture false confidence if the team treats classification as the analysis rather than its beginning. Two sharper versions deserve stating, because both concern how the grid behaves among people rather than how well it models risk.

The first is motivated classification. A team that wants A4 will argue the action is reversible, and the grid hands that argument a respectable, auditable shape. The framework does not merely fail to capture risk; it can launder a preference into a control decision. The answer is not that classification is objective — it is that the classification carries its evidence, its dissent, and a named owner, so the argument stays visible instead of resolving into a cell.

The second is that a floor becomes a ceiling. Once a cell prescribes a minimum, the minimum is what gets built, and “other dimensions can raise the posture” is honored in the document and forgotten in the sprint. Scheduled reclassification arrives too late; it runs after the system is built to the floor. The overlay has to be an entry condition: before implementation, each action is checked against applicable law, contractual obligations, rights impacts, uncertainty, verification cost, and institutional risk appetite, and the decision records whether each raises the T9 minimum. An overlay considered and declined is a recorded decision. An overlay never considered is how a floor becomes a ceiling.

Both objections are correct, and the framework should concede them without retreat. The quadrant is not a risk assessment. It is a minimum-control instrument, forcing 3 things blanket autonomy labels omit: an inventory of actual actions, an explicit account of consequence, and a control decision attached to each. Other dimensions can raise the minimum; they cannot make an irreversible, broad action less consequential because the rest of the system scored well. The comparison is not between this grid and a perfect risk engine. It is between an explicit, revisable floor and oversight inherited from a product setting, copied across a workflow, and left unchallenged until something fails.

Turn the grid into an operating policy

The framework matters only if it changes the system. For each action, record:

• the action and the authority under which it occurs;
• its reversibility analysis, including detection and recovery time;
• its plausible blast radius, including downstream propagation and induced-action exposure;
• its Class I–IV assignment and evidence;
• the initial overlay check — law, contract, rights, uncertainty, verification cost, appetite — and whether each raised the minimum;
• the minimum oversight, its control type, and the enforcement mechanism;
• the current autonomy tier;
• the evidence required to move up a tier;
• the events that force demotion or reclassification;
• the provenance needed to reconstruct execution; and
• the named owner and review date.

Then test the controls. Confirm a Class IV action cannot bypass its gate. Demonstrate a Class II rollback before relying on it. Sample Class I output instead of assuming low consequence means high quality. Exercise the absence path for whoever holds approval authority. Check whether scope drift has changed the classification.

This turns autonomy from a product attribute into an operating decision, and it makes vendor conversations more useful. A system-wide autonomy label does not prove the vendor skipped an action inventory, but it does not reveal one either. Ask for the inventory — which actions run at which tiers, what evidence supports the mapping, and which controls enforce it when the model behaves unexpectedly.

None of the parts here are new. Reversibility as a decision variable is Amazon's. Bounding scope of impact belongs to the reliability and security disciplines. Dual control predates all of it. What this essay contributes is the composition: classifying individual actions on both axes at once, mapping the result to an explicit autonomy tier and an enforced control type, and treating the assignment as a versioned decision with an owner and an expiry. That is a synthesis, not a discovery. Where an action sits on the reversibility axis is often a genuine judgment call; we revise our classifications when assessment evidence changes.

The most capable model is not the one that should receive the most authority. Authority belongs to actions whose consequences, controls, recovery paths, and evidence justify it.

Before deciding which of an agent's actions to delegate, write down everything it can do. The honest answer will not be one number.

The observation this started from: Nobody had one trust level — how authority actually got granted in the institutions I came up in.

Sources

• Jeff Bezos, 2015 Letter to Shareholders (Type 1 and Type 2 decisions).
• Amazon Web Services, “Evaluate tradeoffs while managing benefits and risks”, and “Elements of Amazon's Day 1 Culture.”
• Amazon Web Services, AWS Fault Isolation Boundaries (whitepaper).
• National Institute of Standards and Technology, Security and Privacy Controls for Information Systems and Organizations, SP 800-53 Rev. 5, control AC-3(2) Dual Authorization.
• Federal Financial Institutions Examination Council, Authentication and Access to Financial Institution Services and Systems, Appendix (Privileged User Controls; Customer Controls).
• European Union, Regulation (EU) 2024/1689, Article 14 and recital 73.
• National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0).
• Ancker, Edwards, Nosal, Hauser, Mauer, Kaushal, et al., “Effects of workload, work complexity, and repeated alerts on alert fatigue in a clinical decision support system”, BMC Medical Informatics and Decision Making (2017).
• Wickens, Clegg, Vieane, and Sebok, “Complacency and Automation Bias in the Use of Imperfect Automation”, Human Factors (2015).
• Agudo, Liberal, Arrese, and Matute, “The impact of AI errors in a human-in-the-loop process”, Cognitive Research: Principles and Implications (2024).