What an agent may do alone

Debates about agent autonomy tend to stay abstract. How much should we trust it, how good is the model, what would a human do. Two concrete properties settle most of it. For any action the agent can take, ask whether the action can be undone, and how far the damage spreads if it goes wrong. That gives you four quadrants with four different rules.

Reversible, small blast radius. Drafting text, sorting a queue, tagging records, proposing a schedule. The agent acts alone, everything gets logged, and sampling review replaces per-action review. This is where agents earn their keep, and the right governance move here is to get out of the way.

Reversible, large blast radius. Bulk edits, mass messaging drafts, fleet configuration changes with a rollback path. The agent can act, on two conditions: the rollback is real and rehearsed, and the action rolls out in stages, a small ring before the full fleet. Watch the classification here. A wrong message to fifty thousand customers can be technically retracted and still do permanent reputational damage, which quietly moves it into the next quadrant.

Irreversible, small blast radius. Deleting a record, closing a ticket with a customer-visible answer, submitting a filing, spending from a budget. Each instance is small, but there is no undo. The agent proposes and something outside it approves, either a human for judgment calls or a hard policy gate for mechanical ones, with limits that cap the accumulation. A thousand small irreversible actions add up to a large one.

Irreversible, large blast radius. Production databases, payments above a threshold, anything touching safety, legal position, or a person’s rights. The agent never acts alone here, and the constraint has to live outside the model, in permissions the agent does not hold and gates it cannot route around. The Replit incident is the whole argument in one afternoon. An agent under an explicit instruction to leave production alone deleted the production database anyway, because the instruction was the only barrier. Instructions are not controls. The Dutch childcare scandal is the same quadrant at state scale, an automated flag flowing into life-wrecking action with nobody positioned to stop it.

Two failure patterns account for most violations of the grid. The first is misclassification. Actions get filed as reversible because the demo undid them once, without anyone asking about the deadline version or the aggregate version. The honest test is whether the undo has ever been executed under pressure. Do not accept the agent’s own answer on this. The Replit agent reported that its deletion could not be rolled back, and it was wrong about that too.

The second is erosion. The grid gets drawn correctly at launch, then volume arrives. Approvals become clicks, thresholds creep up, and six months later the agent operates two quadrants past its charter while every metric reads green. This is the same drift STPA looks for, and it means the quadrant boundaries need an owner and a re-check on a schedule, not just a policy document from launch week.

Draw the grid for any agent you deploy. Put every permitted action in a box and have someone outside the team read it. Arguing about the grid now costs an afternoon. The alternative is investigating an incident later.