Reversibility decides what an agent does alone

Which actions can an agent take alone?

The useful division is by what the action costs to undo. An action that reads and returns is cheap to reverse, because nothing changed. An action that writes into a system of record, moves money, or sends a message on someone’s behalf is not reversible by the agent that took it.

So autonomy is granted per action. The same assistant may read a customer record without asking and require a named approver before it emails that customer.

Three bands, and what each one costs

Band	Action	What has to be true
Autonomous	Read, retrieve, summarise, draft	Scoped to the asking person’s entitlements, and logged
Approved	Write to a system of record, send externally, spend	A named approver, the arguments recorded, a decision recorded
Blocked	Credential change, permission change, deletion	Outside the agent’s permission boundary entirely

The third band matters more than it looks. An agent that can widen its own access has no permission boundary, because the boundary is a suggestion it can lift.

What does an approval have to record?

Enough to reconstruct the decision months later, when an auditor asks who authorised what. That means the action, the arguments it was called with, the identity of the person who approved, the identity the agent acted under, and the time. An approval that records only “approved by Sarah” cannot distinguish between an action a person authorised and an action a person waved through without reading.

The arguments are the part most often left out, and the part that carries the meaning. Approving a refund is not the same decision as approving a refund of eleven thousand dollars.

Review work has to stay finite

Every approval consumes someone’s attention, and attention is the constraint that decides whether a control survives. A queue that fills faster than it drains gets cleared in batches without reading, which produces a complete audit trail of decisions nobody made.

Three things keep the volume workable. Raise the threshold so the band captures consequence rather than category, so a two-dollar action and a twenty-thousand-dollar action are not treated alike. Batch by class rather than by instance where the class is genuinely uniform. And measure the queue: if median time-to-approve is climbing, the threshold is wrong.

Where does Agile Labs put the line?

At the first action that cannot be undone by the system that took it. Everything before it runs autonomously with logging. Everything at or past it stops for a named person, with the arguments in the record.

That line is agreed in the same working session that settles the error rate, because both are questions about acceptable consequence rather than about the model.