Canonical flow

Transaction / trade execution gate

Irreversible action gate for material financial execution.

Abstract pattern

Irreversible action gate

The counter-example that proves PAA is not autonomy-maximalist: material execution stays gated because the failure cost is effectively unbounded.

Worker: Upstream automation proposes the transaction or trade.
Boundary: Input is the proposed transaction, including instrument, size, price, and context. Output is allow, block, or require-human.
Evidence log: Proposed action, gate verdict, human decision when required, and realized outcome such as fill, slippage, P&L, or breach.
Evaluator: Deterministic invariants do the heavy lifting.
Promotion rule: Deliberately capped. The gate does not graduate to full autonomy for material actions because irreversible failure is too costly.
Demotion rule: Any breach or near-miss tightens limits immediately, and invariant violations trigger the kill-switch.
Fallback: Human-required for material or policy-edge actions.
Lives: Deterministic blocking gate always, with human-in-the-loop control for anything that matters.

Evaluator detail

What the gate actually checks

Target: Output and outcome
Technique: Position limits, price bounds, whitelists, and kill-switch conditions gate the action. Model signals remain advisory only.
Oracle: Hard policy constraints for permissioning and realized outcomes for monitoring.
Position: hitl

Teaching point

Risk-adjusted failure cost sets the bar, and irreversible actions stay under deterministic gating rather than learned judgment.

Six questions

Without PAA: Model signals become execution signals without a deterministic gate; a single mispriced or oversized action can cause material financial harm before any human can intervene.
What gets gated: Material execution — any transaction that exceeds position limits, price bounds, or whitelist conditions is blocked by the deterministic gate before it reaches the market.
What is logged: Proposed action, gate verdict, human decision when required, and realized outcome including fill, slippage, P&L, and any breach or near-miss.
Earns promotion: Deliberately capped — the gate does not graduate to full autonomy for material actions regardless of past performance because the failure cost is asymmetric.
Triggers demotion: Any breach or near-miss tightens limits immediately; invariant violations trigger the kill-switch and require a human reset before execution resumes.
Never full-auto: Material financial execution — the failure cost is effectively unbounded, so deterministic gating is permanent rather than a transitional state.

This page is linked from the canonical card set on the flows index.