When an agent publishes under a person's name, it holds a piece of that person's reputation.

The usual control for this is a switch in the settings page reading "post automatically". One click grants the whole thing, on no evidence, at the moment the user knows least about how the agent behaves.

We built a ladder instead. This is how it works and why it is shaped the way it is.

1. What makes this delegation unusual

Three things.

A wrong purchase can be refunded. A published fabrication attributed to a founder cannot be taken back in any way that matters. Deleting it does not unread it.

The user sees a sample of what the agent produces, not all of it. Confidence built on a sample is confidence built on a sample.

The agent's mistakes are not independent. If its model of the user's voice has drifted, it produces a hundred wrong items, not one.

A single switch ignores all three. It turns a graded, evidence-dependent question into one irreversible choice made at setup.

2. The ladder

Five rungs, ordered.

RUNGLEVELTHE AGENT MAYTHE PERSON MUST0suggest onlypropose an ideawrite it and publish it1draft, approve eachwrite a full draftapprove every item2approve by exceptionqueue it for a quick lookglance, then release3limited autonomypublish clean items alonenothing, per item4full autonomyrun end to endnothing, per itemThe line sits between rung two and rung three. Filled rungs publish without a person.
Figure 1. The rungs are integers so that taking a minimum between them means something. Every cap in the system is written as a minimum against a rung.

One comparison decides everything:

approval required  if  effective rung < 3

The rest of this piece is about computing that rung honestly.

3. Three caps

The rung for one item is the smallest of three quantities that measure different things.

CAP A, the ceilingwhat the person permittednever exceededCAP B, the recordearned from past approvalsslow to rise, quick to fallCAP C, this draftthe quality check's scorethis item, not the averagesmallestthe rung for this itemRISK, checked first, overrides the resulta hard stop returns rung one whatever A, B and C sayWe take the smallest, not an average, so no cap can be bought off by another.
Figure 2. The three caps and how they combine.

Taking the smallest rather than a weighted average is the central choice. An average allows compensation: a strong record outvoting a weak draft. That is exactly wrong, because the three caps answer unrelated questions. Am I allowed. Have I proved myself. Is this particular thing any good. Yes to two of those is not a yes.

4. Earning a rung

From a decision history we compute two rates:

agreement  = approved without edit / all decisions
correction = approved with edit    / all decisions

Two rates, not one, because they measure different failures and are not complements of each other. Agreement says whether the agent is right. Correction says whether the person is doing the agent's job. A high correction rate is not a mild signal. It says the user is rewriting the output, and that is not a reason to publish more of it unattended.

decisions observedagreement rateno record yetrung onerung two, approve by exceptionrung three, limited autonomyrung four, full autonomy10300.800.920.001.00A correction rate above 0.40 collapses the whole surface to rung one.
Figure 3. Volume gates the vertical axis. An agreement rate over fewer than ten decisions is not evidence, whatever its value.

The procedure reads:

fewer than 10 decisions        -> rung 1
correction rate above 0.40     -> rung 1
agreement 0.92 or better, and
  at least 30 decisions        -> rung 4
agreement 0.80 or better       -> rung 3
otherwise                      -> rung 2

Volume is checked before the rate. Three approvals out of three is a perfect score and means nothing, which is why the left of that surface is flat and low however high the rate climbs. We apply the same discipline to per topic engagement elsewhere in the system, for the same reason: at this scale a raw ratio over a handful of observations is noise dressed as a measurement.

5. Order, and the guarantee it buys

The order in which we evaluate one item is not incidental. It is the safety property.

one draft, with its risk findings1. high severity, or a category that isnever allowed to run alone?yesrung one, approval neededthe ceiling is not read2. any medium severity finding?yescap at rung two3. was the repetition check able to run?nocap at rung two4. smaller of the ceiling and the record5. the draft's own confidence, 85 then 75rung, reason, and what bound itabsolutecappedcappedearnedper item
Figure 4. Step one returns before any other input is read, which makes the guarantee testable rather than merely intended.

Step one does not consult the ceiling, the history, or the confidence score. It returns. A user at the top rung with a perfect record and a draft scoring ninety-nine still receives an approval request if the item touches one of these:

Category Why it can never run alone
Legal exposure Liability cannot be handed to a model
Confidential material Disclosure cannot be undone
Unreleased product Timing is a business decision, not a writing one
A live controversy Context moves hourly and the model's is stale
Personnel It concerns a third party who did not agree to it

Separately, any high severity finding triggers step one whatever its category, and any medium finding caps at rung two. Severity and category are two conditions on the same step.

There is one further case in step three that is easy to get wrong. When the repetition check could not run, the input is absent, not clean. Treating "we could not check" as "it is fine" is how a system manufactures confidence out of an outage. So it caps, with a plain sentence:

I couldn't verify this isn't a repeat, so I'd rather you glanced at it.

6. The draft's own score

The last cap is per item, using the quality check's score on a scale of zero to a hundred.

Rung four wants at least eighty-five. Rung three wants at least seventy-five.

Falling short drops one rung, not all of them. A rung four user with a draft scoring seventy-nine lands on rung three. The fault is in the draft, not in the relationship.

7. Eligibility is a different mechanism

Autonomy decides who releases an item. Eligibility decides whether the item should exist at all. Confusing the two is the common design error, so it is worth separating them plainly.

Eligibility is seven yes-or-no gates, evaluated before any ranking:

Gate It fails when
Novelty The candidate repeats a claim already made
Provenance A specific assertion has no evidence behind it
Risk There is a high severity finding
Consent The supporting data is not lawful to publish from
Cadence The daily budget is spent, or the gap is too short
Authority Standing on the topic is known to be low, and it is not the user's own work
Frame The run length limit on frames has been reached

The gates are binary and are not folded into a score. If they were, a high enough trend score could outvote a repetition. A repeat is not a slightly worse opportunity. It is not an opportunity.

Ranking runs afterwards, over survivors only, on six features that share a unit: signal confluence at 0.25, available specificity at 0.20, user fit at 0.20, timeliness at 0.15, audience pull at 0.12, frame gap at 0.08. Each is a share between zero and one of something observable, which is the condition under which adding them up means anything.

The authority gate has an exemption worth naming. Low standing blocks. Unknown standing does not, because a person has to be able to write about something for the first time. And neither applies when the opportunity comes from the user's own life: an event, a product, or a direct request. A person always has standing to discuss their own work, whatever a model has inferred about their expertise.

Every gate returns a sentence whether it passes or fails, and the rejected set is kept and shown. Fourteen things considered, eleven rejected, here is why, is the clearest demonstration that a manager rather than a generator is running.

8. The numbers

Constant Value
Agreement for limited autonomy 0.80
Agreement for full autonomy 0.92
Decisions before any autonomy 10
Decisions before full autonomy 30
Maximum correction rate 0.40
Confidence floor, rung three 75
Confidence floor, rung four 85
Minimum authority to speak 0.15

The authority floor is low on purpose. It exists to block presumption, not curiosity.

9. Every decision explains itself

Each decision returns three things: the rung, a sentence, and the name of the constraint that bound it. That constraint is one of the ceiling, risk, confidence, the record, the correction rate, an unverified repetition check, or nothing.

The third field exists so that "why did this need approval" is a query rather than a debugging session. Without it, a system silently capping everyone at rung two because of a misconfigured threshold looks the same as a system working correctly.

The sentence is written for the user:

You've been rewriting most of my drafts, so I'll keep asking first. You've agreed with 12 of my last 40 suggestions.

An autonomy decision the person cannot interrogate is one they cannot revoke intelligently.

10. Where this is weak

The history is not weighted by time. Agreement counts every decision equally, so a model that drifted last week is diluted by three months of prior agreement. A decayed weighting is the right treatment and we have not built it.

Approval is a noisy stand-in for quality. Someone clicking through a queue to clear it is recorded the same as someone who read carefully. The signal gets worse exactly as trust grows, which is the wrong direction.

The guarantee is bounded by detection. Step one always requires a person given a correct finding. It does not guarantee that every dangerous item produces a finding. The classifier upstream is the real limit and we have not characterised it.

The ladder assumes autonomy is one dimensional. It probably is not. Someone might reasonably grant full autonomy for routine product updates and none at all for anything touching opinion. We can only express that today through risk categories, which is a coarse substitute.

11. In short

Delegating the authority to publish should be graded, based on evidence, and revocable per item. Those three requirements give a ceiling the user sets, a rung the agent earns, a floor each item must clear, and a class of content that never qualifies.

We take the smallest of them so nothing compensates for anything else, and we check risk first so its dominance is a property of the control flow rather than of the weights. That difference is what separates a guarantee from an intention.