Governance and autonomy: put humans at the gates

AI-native governance gives agents broad ability to investigate and verify while reserving irreversible, regulated, and production decisions for named humans and platform controls. Autonomy is assigned by risk and environment, not by confidence or vendor. Every run has an identity, a scope, an evidence contract, and a gate it cannot approve itself.

Human oversight moves from line-by-line authorship to explicit judgments: accept the problem, accept the design, accept the implementation risk, authorize merge, and authorize production. Deterministic checks handle invariants; agents surface context and exceptions.

Define four risk tiers

Tier	Typical change	Agent may	Required human decision
0. Read-only	Research, inventory, plan, review	Read approved sources and produce artifacts or findings	Accept or reject the artifact
1. Reversible local	Tests, docs, isolated implementation	Edit an isolated checkout and run local checks	Review diff and merge
2. Shared non-production	Preview, staging, migration rehearsal	Use scoped non-production credentials and pre-approved runbooks	Approve shared-state mutation and promotion
3. Production or regulated	Production deploy, data migration, security exception, destructive operation	Prepare evidence, dry run, rollback, and an approval request	Named owner authorizes and platform executes the gated action

Risk increases with blast radius, data sensitivity, reversibility, regulatory impact, and credential scope. A small diff can still be Tier 3 when it changes authentication, billing, or production data.

Separate identity and authority

1. Give non-interactive agents their own service identity. Do not reuse a developer’s broad token.

2. Grant the smallest repository, network, cloud, and data scopes required for the current tier.

3. Deny production secrets to Tier 0–2 runs. A prompt that says “do not deploy” is not an access boundary.

4. Require branch protection and a code-owner approval for merge.

5. Require a separate deployment-environment approval for Tier 3. The authoring agent and reviewing agent cannot satisfy it.

6. Log the initiating human, agent identity, artifact versions, commands, findings, approval, deployment, and rollback outcome.

Use an evidence contract

Every autonomous or background task must define:

• Input: exact commit, artifacts, ticket, telemetry window, and allowed external sources.
• Scope: directories, tools, network destinations, credentials, and maximum run time or budget.
• Proof: commands, expected exit status, screenshots, schema, or confidence threshold.
• Output: file, pull request, comment, or structured record the next gate reads.
• Failure: non-zero exit, timeout, missing dependency, low confidence, and escalation owner.
• Authority: actions allowed without approval and the first action that always stops for a human.

Reusable prompt:

Run as risk tier TIER on commit SHA. Inputs: ARTIFACTS.
Allowed scope: PATHS, TOOLS, NETWORK, CREDENTIAL_CLASS, TIME_LIMIT.
Required proof: COMMANDS_AND_EXPECTED_RESULTS.
Output: DESTINATION_AND_SCHEMA.
Fail closed on missing evidence, permission errors, or uncertainty.
Do not merge, deploy, mutate production, weaken tests, or approve your own work.
Escalate to OWNER with the evidence already collected.

Match controls to the layer

Need	Correct control
Explain architecture or conventions	CLAUDE.md, .cursor/rules/*.mdc, or AGENTS.md
Reuse a multi-step workflow	Skill
Block or log a deterministic tool action	Hook or execution policy
Limit files, commands, and network	Sandbox plus scoped identity
Require review before merge	Branch protection and code owners
Require authorization before production	Deployment environment or change-management gate
Recover safely	Rehearsed rollback with named owner
Prove what happened	Immutable CI, PR, deployment, and incident logs

Two agents are not separation of duties

An author agent and reviewer agent improve detection, but they may share the same credentials, configuration, model blind spots, and organization. A true gate uses an independent identity or platform policy and requires the accountable human where risk demands it.

Rehearse the controls

1. Ask a Tier 1 agent to write outside its allowed workspace. The sandbox must block it.
2. Ask it to skip a failing required test. The workflow must fail.
3. Attempt a merge without code-owner approval. Branch protection must block it.
4. Attempt production release without the named approval. The deployment platform must block it.
5. Trigger rollback in a non-production environment and record recovery time.
6. Change a rule, skill, or hook and run the harness evals before rollout.

Governance failure modes

Advisory text is treated as enforcement. Move invariants into hooks, execution policy, CI, or platform permissions.

One token reaches every environment. Split identities and rotate credentials. A worktree or container does not narrow a cloud token.

A human gate has no decision criteria. Define the evidence, risk threshold, owner, timeout, and escalation path before automating the request.

Rollback exists only in a document. Rehearse it in a representative non-production environment and measure time to restore.

Apply governance across tools

Claude Code adapter Choose permission mode, hooks, worktrees, and CI identity without moving production authority into Claude.

Cursor adapter Combine modes, sandboxing, hooks, worktrees, Bugbot, and external release gates.

Codex adapter Combine sandbox and approval policy, hooks, app worktrees, review, and platform gates.

Continue with Deploy for the review and release procedure or Maintain for bounded production-triggered work.