Five parts govern one task

01

A bounded task

Authority is assigned to a bounded task. It has observable input and output and a scope narrow enough that evaluation results mean something. “Approve a refund under $100 for an established customer” is governable. “Handle customer operations” is not.

The boundary identifies the effect under control, such as sending a message or moving money. Oversight applies there.

Task identity and scope must remain stable enough to compare executions. If a policy change materially changes what counts as a valid refund, the new work should not silently inherit evidence gathered under the old policy.

02

An evaluator outside the worker

The worker does the task. The evaluator judges whether the task’s current level of authority remains justified. Separating those roles prevents the worker’s own confidence from serving as the only evidence for its authority.

Evaluators can be deterministic checks, classifiers, model judges, human review, or combinations of them. The choice depends on the property being measured and the cost of a wrong verdict. The evaluator reference defines the complete model.

A hard policy check can block prohibited refunds while a reviewer or classifier judges ambiguous cases. Each result identifies what was measured and which evaluator produced it.

03

Evidence retained across executions

A single passing result says little about sustained operation. The system retains evaluator results with enough context to identify the task, its scope, the evaluator version, and the observed outcome. Promotion rules operate over that history.

Evidence must remain available after a decision so the team can reconstruct why authority changed and determine whether later results are comparable.

The schemas define the record format without requiring one database or runtime.

04

Promotion and demotion rules

A promotion rule states what evidence makes a task eligible for less oversight. A refund task might require 200 qualifying cases above a success threshold with no policy violations. Eligibility informs an authority decision. The decision is recorded separately.

Demotion rules state when tighter oversight returns. They can respond to a measured trend or a single severe failure. Operators must also be able to intervene without waiting for a statistical window to close.

05

A real fallback

The safer mode must remain operational. The system must be able to restore a blocking check, route work to a person, pause the governed effect, or otherwise return to the declared lower-authority position.

Fallback behavior belongs in routine operational testing. Queued work must reach reviewers, blocking checks must stop the effect, and execution must read the current position. Demotion cannot depend on an emergency path nobody has exercised.

Declaration

Task declaration

task: refund_approval
scope: routine_refunds_under_100
position: human_in_the_loop
evaluator: refund_policy_review
promotion: 200 qualifying passes
demotion: any confirmed policy failure
fallback: mandatory_review

Real declarations carry versions, identities, evidence requirements, and decision metadata. Normative schema