Governed Autonomy Journey

State: none yet; the boundary is not yet declared.

Before measuring performance, define exactly what work you are measuring. Name the input, the output, the real-world effect, and the work that remains outside the boundary.

Our running example is bounded_publication. It accepts a draft_post and may produce a published_post for either a community or professional channel. Publishing anything outside those channels is excluded.

PAA records this stable boundary in a task declaration. The declaration defines the work; it does not authorize the system to perform it.

Invariant: An unbounded workflow cannot enter the spectrum: no typed boundary, no evidence, no gate.

Lifecycle: Bound →

State: position manual, deployment active for scope publish:community

Capture the existing workflow before adding automation. Record each draft, the published result, and the human decision so later comparisons use observable executions rather than memory.

A person still writes and publishes every post. PAA calls this manual, the first governed position: the task is active and observable, but the human performs the real-world effect.

A minimal structural check confirms that each output was recorded. Its result is the first evidence record for the task.

Invariant: Manual is the first on-spectrum position: the human performs the effect, and the effect is observable.

Lifecycle: Instrument →

State: position manual, deployment shadow for scope publish:community

Now the candidate worker turns each draft post into a candidate publication, but its output never reaches a reader. The human continues to publish the real result.

This production context reveals how the candidate behaves without giving it production authority. PAA calls this shadow operation.

The system records the candidate output beside the human-controlled outcome so the next stage can compare them. Being evaluated in production context is not the same as having production authority.

Invariant: A shadow deployment and an advisory verdict can each accumulate evidence, but neither can authorize the governed effect.

Lifecycle: Evaluate →

State: position manual, deployment shadow for scope publish:community

How do we know whether the worker performed correctly? A rubric-driven model and a human reviewer each judge publication_quality for the same candidate publications. Each judgment identifies what was measured, how it was produced, and which evaluator version produced it.

Individual judgments are observations. PAA keeps them as evidence so performance can be assessed across many executions.

Before governance uses that evidence, a declared policy checks which records qualify. PAA calls qualifying evidence admissible. A decision artifact freezes the 200-case window, records every inclusion and exclusion, and states whether the promotion conditions passed.

Invariant: Recorded evidence is not automatically admissible evidence; admissibility is a declared, snapshotted decision.

Lifecycle: Accumulate →

State: position manual, deployment shadow for scope publish:community

The accumulated evidence now satisfies the declared requirements for considering less oversight. PAA calls the task eligible for a different position.

Eligibility changes nothing by itself. The worker still runs in shadow, both publishing scopes remain manual, and a governance decision is still required.

Invariant: Eligibility is a decision-artifact outcome, not a position change. A motion must still be proposed and resolved.

Lifecycle: Promote →

State: position manual, deployment shadow for scope publish:community

A proposal now asks governance to move publish:community from manual to human-in-the-loop review. PAA calls this proposal a motion and binds it to the decision artifact that contains the supporting evidence.

operator:jordan_lee reviews that evidence and approves the motion. A rejection would end the proposal and leave oversight unchanged.

Evidence justified considering the change. The governance decision, not the evidence, approves it.

Invariant: A motion is proposed and resolved by a named actor or a system actor. It does not fire itself.

Lifecycle: Promote →

State: position hitl, deployment shadow for scope publish:community

The approved motion changes one declared scope: publish:community moves from manual to human-in-the-loop review. PAA calls this level of oversight the task's position.

The professional channel remains manual. Autonomy is scoped rather than global, so approval for one channel never changes its sibling.

PAA records the change as an event. The ordered event history is the source used to reconstruct the current position.

Invariant: position_changed is scoped to exactly one declared scope; no other scope is affected by the same motion.

Lifecycle: Promote →

State: position hitl, deployment active for scope publish:community

The community worker now prepares each publication. Its blocking checks must pass, and a human still authorizes the final action. Low-confidence cases can route directly to the human without changing the position of the whole scope.

Evaluation continues during active operation. When a validated classifier replaces the rubric judge, PAA creates a new declaration version and starts a new evidence partition. Historical records keep the worker and evaluator context that produced them; replacement never rewrites the past or silently inherits prior authority.

Invariant: Deployment and evaluator succession require new declaration versions; neither silently mutates a position or an evidence record already on file.

Lifecycle: Gate →

State: position manual, deployment active for scope publish:community

Promotion did not end evaluation. After one confirmed publishing failure, the current evidence no longer supports human-in-the-loop operation for the community channel.

operator:jordan_lee approves an immediate demotion, returning publish:community to manual. The professional channel is unaffected. The same governed path that reduced oversight now increases it again.

Invariant: A policy failure or an operator can demote immediately, on a one-case window, for the affected scope only.

Lifecycle: Demote / Fall Back →