1Introduction

The twentieth-century firm was a hierarchy of humans coordinated by managers, memos, and meetings; software was a tool the humans used. That arrangement is inverting. As autonomous agents acquire persistent identity, durable memory, and the ability to take consequential external actions, the firm becomes a hierarchy in which agents perform the labor and humans supervise.² Software is no longer the tool. Software is the workforce.

Most current discussion of this transition concerns model capability—whether a given system is competent enough to perform a given task. We take capability as a moving and largely exogenous input, and direct attention instead to a problem that becomes harder, not easier, as capability improves: the problem of governing a workforce that acts faster than any human can review.

1.1Three steps: answers, tasks, roles

It is useful to place the framework in the short history of the technology it governs. The unit of value delivered by AI systems has shifted twice and is now shifting a third time. In the first step, LLMs deliver answers: the human asks, the model responds, and the human performs all consequential action. Governance is trivial because the system has no effectors.³ In the second step, agents deliver tasks: the system plans, invokes tools, and acts in the world—but within a session, on demand, and then evaporates. Safety, where present, is improvised: per-application permission prompts, sandboxes, ad-hoc approval dialogs—features, not institutions. In the third step, AI employees deliver roles: the system holds a mandate over time, accrues a track record, and is governed institutionally. AEF is a specification of that third step.

Three qualifications keep this framing honest. First, these are layers, not eras: the LLM is the engine inside the agent, and the agent loop is the engine inside the employee; nothing in the ladder is superseded by the rung above it. Second, the deficiency of the second step is not the absence of safety mechanisms—today's agent platforms have permission systems and sandboxes—but the absence of institutional discipline: autonomy that is configured rather than earned, safety that is per-application rather than organizational, and no accountability chain. The distinction is that between a merchant keeping cash in a strongbox and a banking system with audits, capital requirements, and examiners; the strongbox is a feature, the banking system is an institution.

Third, and most consequentially: what separates the third step from the second is not governance alone but persistence—and persistence is what makes governance possible at all. Earned autonomy, trust progression, and a track record cannot attach to a system that resets between sessions; there is no continuous entity to hold the record. Durable identity (Principle 2) is therefore not a convenience but the precondition of the entire discipline: identity makes accountability possible, and accountability makes governance meaningful. This, in our view, is why institutional governance cannot simply be patched onto today's session-scoped agents—the substrate it requires is missing.

The ladder also has ends. Below the first step sits pre-LLM automation—scripts and robotic process automation—which was deterministic, perfectly auditable, and unintelligent; the arc of this paper can be read as an attempt to re-earn that auditability without surrendering the intelligence. Above the third step, the unit of analysis moves from the employee to the organization—deputies, typed coordination, entity ownership (§7)—and eventually to organizations transacting with one another. AEF is offered as the discipline that makes the third step real and the fourth conceivable.

1.2The throughput limit of human governance

The intuitive safety story for autonomous systems is human-in-the-loop approval: a person signs off on each action before it commits. This story is coherent at small scale and incoherent at organizational scale. A single human cannot meaningfully adjudicate ten thousand decisions in a day; attention is the binding constraint, and it does not scale with the size of the agent fleet. Two unsafe equilibria follow. In the first, the approval queue is honored but becomes a bottleneck that destroys the value of automation. In the second—far more common in practice—the queue is nominally honored but approvals degrade into rubber-stamping, and human supervision becomes ceremonial. Neither equilibrium is defensible.

The framework we propose rejects both. It accepts that humans cannot review everything and asks instead a more answerable question: what is the minimum discipline under which most decisions can be governed by other agents, while humans retain authority over the decisions that matter and accountability for all of them?

1.3Process discipline, not model quality

AEF is deliberately agnostic to the underlying model. A framework pinned to the capabilities of any particular model would be obsolete on the next release. Instead, AEF specifies properties of the surrounding process: how an agent earns and loses authority, how its outputs are reviewed before they reach the world, how conflicting obligations are resolved, how its actions are recorded, and how the organization degrades when a vendor fails. These properties are testable independently of how clever the model is on any given day. A more capable model deployed in an undisciplined process is, we argue, strictly more dangerous than a weaker one deployed in a disciplined one.

1.4Status and scope of this paper

We present AEF as a position paper and architecture proposal. The framework is derived from production experience building agent infrastructure, and its requirements each trace to an observed or anticipated failure mode (§12); however, this paper does not report controlled empirical results, and we identify multi-deployment validation of its tunable parameters as the principal item of future work (§13). The normative specification—exact thresholds, data schemas, and conformance tests—is maintained separately and is not reproduced here.

1.5Contributions

This paper makes the following contributions:

1. A delegated-supervision model in which senior agents (deputies) govern peers within bounded authority, subject to anti-collusion invariants that preserve human oversight (§7).
2. A proportional critic-ensemble design that resists single-point judgment failure and, through a counterfactual signal, resists the Goodhart failure of selecting for blandly acceptable rather than genuinely good output—together with a candid account of that signal's supervision cost (§6).
3. A defense-in-depth security posture combining provenance labels on all context with deterministic, model-external enforcement of everything that leaves the trust boundary (§8).
4. An explicit loyalty-precedence formalism that makes the resolution of conflicts among law, user, and operator a declared, auditable property rather than an emergent artifact of prompt phrasing (§9).
5. A separation between the authoritative audit record and diagnostic replay, recognizing that non-deterministic systems cannot treat re-execution as evidence (§10).
6. A consolidation of the above into five layers, thirteen principles, three conformance profiles, and a taxonomy of named failure modes (§3–§5, §11–§12).

2Background and related frameworks

2.1Why prior arrangements fail

Three default arrangements recur in deployed multi-agent systems, and each fails in a characteristic way that motivates a corresponding requirement in AEF.

Unbounded human-in-the-loop. As argued above, full per-action approval does not scale and collapses into ceremony. AEF replaces the binary approve/automate switch with earned autonomy: a trust level that an agent accrues from track record and forfeits automatically on material failure (§5).

Ungoverned agent collectives. A popular pattern lets agents coordinate by exchanging free-text messages—an arrangement we term the Manager Soup. Free text is unbounded in its effects: it permits agents to negotiate, to contradict one another on the same business entity, and to propagate injected instructions. AEF prohibits free text as a coordination mechanism and requires typed handoffs and explicit, leased ownership of every entity that can be written to (§7).

Single-critic review. Routing every action past one reviewing model concentrates judgment in a single point of failure that shares the producer's blind spots and can be socially engineered by adversarial input. AEF requires an ensemble of independent reviewers, including a deterministic, non-hallucinating critic and a model critic drawn from a different vendor family (§6).

2.2Levels of automation

Graduated autonomy is not a new idea. Aviation and automotive engineering have spent decades formalizing levels of automation, most visibly in the SAE J3016 taxonomy for driving automation [5], which defines a ladder from full human control to full autonomy with explicit conditions at each rung. AEF's trust levels are the same idea transposed to knowledge work, with two additions the driving context does not need: per-agent progression based on individual track record rather than system certification, and automatic demotion on failure. Sheridan and Verplank's earlier ten-level scale of human–computer decision authority [6] anticipates the structure of the ladder itself. We regard this lineage as a strength: AEF asks organizations to manage AI autonomy the way safety-critical industries already manage machine autonomy—by graduated, conditional, revocable levels—rather than by a binary on/off switch.

2.3Regulatory context

The EU AI Act's Article 14 requires that high-risk AI systems be designed for effective human oversight, including the ability to understand, monitor, intervene in, and interrupt the system's operation [7]. We read Article 14 as legislating the goal while leaving the mechanism open—and as implicitly acknowledging the throughput problem, since "effective" oversight of a system making thousands of decisions cannot mean per-decision review. AEF can be understood as one concrete proposal for what effective oversight looks like at scale: delegated but acyclic supervision (§7), an interruption capability in the form of org-wide pause with a verified break-glass procedure (§11), decision-time explanations recorded rather than reconstructed (§10), and an audit trail robust enough to demonstrate all of the above to a conformity assessor.

2.4The principal–agent lens

The underlying economic lens is the classical principal–agent problem [4]: a principal delegates to an agent whose incentives and information differ from its own. The novelty here is that the agents are software, the delegation operates at machine speed, and—uniquely—the principal can delegate the supervision itself to other agents, provided the delegation is constrained so as not to dissolve the principal's authority.

3Design principles

AEF rests on thirteen commitments. They are commitments, not features: each constrains how the system may behave regardless of which model implements it, and each traces to a named failure mode in §12. Table 1 states them with their rationale; subsequent sections develop the load-bearing ones.

Table 1. The thirteen design principles with one-line rationale. Principles in bold are developed at length in later sections.

#	Principle	Commitment and rationale
1	Mandate over instruction	Agents act on signed, versioned charters, not ad-hoc prompts — so authority is inspectable, not improvised.
2	Durable identity	State, voice, and history persist across sessions — accountability requires a continuous someone to hold accountable.
3	Signals, not polling	Action is triggered only by typed events with provenance — every act has a traceable cause.
4	Earned autonomy	Trust is gained from record, lost on failure, with no manual override — autonomy is evidence, not configuration.
5	Cite or refuse	Every claim traces to a sourced fact — ungrounded assertion is treated as a defect, not a style.
6	Ask before guessing	Below a confidence threshold the agent escalates — a question is cheaper than a wrong action.
7	Reversible by default	Irreversible actions need fresh, explicit consent — the undo button is a governance primitive.
8	Ensemble before commit	External actions pass independent reviewers, in proportion to stakes — no single point of judgment failure.
9	Tamper-evident audit	The authoritative record is append-only and chained — history cannot be quietly rewritten.
10	Budget as first-class input	Cost, latency, and vendor reliability enter the plan — economics is part of the decision, not an afterthought.
11	Shadow before promote	New skills, prompts, and models prove themselves without acting first — change is rehearsed, then released.
12	Human accountability	Final authority is human; any decision may be overridden — delegation never becomes abdication.
13	Declared loyalty	Conflicts resolve against an explicit precedence stack — whose interest wins is written down, not improvised.

4Architecture

AEF organizes an AI-run organization into five layers over a shared cross-cutting substrate (Figure 1). The layering is not merely descriptive: each layer is the unit at which a distinct class of policy is enforced. The employee is the atomic unit of labor; the team is the unit of coordination and entity ownership; the organization is the unit of policy and capital; the operating loops impose temporal cadence; and the top layer is where human and deputy governance act.

5 · Human Governance + Deputiescharters · overrides · incidents

4 · Operating Loopsday / week / quarter cadence

3 · The Organizationpolicy · capital · model registry

2 · The Teamhandoffs · entity ownership

1 · The Employeeatomic unit of labor

cross-cutting substrate  ·  signal bus  ·  memory fabric  ·  skill registry
audit plane  ·  budget meter  ·  model registry  ·  egress control

An employee in this framework is an autonomous agent with a stable immutable identity and a signed charter stating its purpose, success metrics, scope, forbidden actions, and—critically—its blast radius: the maximum cost, recipient count, record count, and irreversibility any single action may incur. The charter also declares the agent's loyalty precedence (§9), its jurisdiction, and the classes of regulated data it may handle. An employee missing any required charter element is a draft and receives no live signals.

5Earned autonomy and the trust lifecycle

Authority in AEF is not configured; it is earned and forfeited through a lifecycle (Figure 2). A newly authored agent is drafted, then enters a probation period in which it receives synthetic and canary signals under intensified review and a reduced blast radius. On passing probation it enters shadow, where it processes real signals but emits only to a shadow log, its outputs compared against ground truth without taking effect. Only after a shadow window and explicit supervisor approval does it go live, and even then it begins at the lowest acting trust level.

Drafted→ Probation→ Shadow→ Live→ Retired

The lifecycle encodes a deliberate asymmetry, which we regard as a safety property in its own right: demotion is automatic; promotion is gated. A material failure or policy breach lowers an agent's trust without any human action, whereas raising trust always requires an authorized ratifying signature. The system thus fails toward less autonomy, never more.

Promotion criteria combine a sustained record of accepted, unedited actions with two anti-gaming signals developed in §6. The precise thresholds are deployment-tuned and belong to the normative specification; what matters architecturally is that acceptance alone is treated as insufficient for promotion, for the reason we now develop.

6The critic ensemble: proportional, cross-family, and Goodhart-resistant

Every external-facing action must clear a panel of independent reviewers before it commits. We require, at minimum, three kinds of critic. The first is deterministic: rule-based, schema-validating, and policy-enforcing. It cannot hallucinate and cannot be socially engineered, and it is always required. The second is a model critic drawn from a different vendor family than the producer; same-family critics share systematic blind spots, so an ensemble built from one model's many instances offers correlated rather than independent judgment. The third is retrospective: a periodic process that re-scores past actions against their realized outcomes—did the deal close, did the recipient reply, was the action rolled back—and feeds the result back into trust progression.

6.1Proportionality: review depth scales with blast radius

A multi-critic ensemble is not free. Each model critic adds inference cost and latency, and a cross-vendor critic can roughly double the per-action model spend. Applied uniformly, the governance of a fifty-cent action could cost more than the action is worth. AEF therefore treats ensemble depth as proportional to blast radius: the deterministic critic gates every action without exception, while the number and strength of model critics, the quorum rule, and the sampling rate of retrospective review all scale with the action's declared stakes—its cost, recipient count, and irreversibility. A low-stakes internal draft may pass on the deterministic critic plus a sampled model review; an irreversible, high-value external action faces the full conjunctive ensemble. Proportionality preserves the economics of automation while concentrating expensive judgment where errors are expensive.

6.2Acceptance is a corruptible metric

Goodhart's law holds that a measure under optimization pressure ceases to measure what it once did [2]. If an agent's trust progresses on the rate at which its outputs are accepted without edit, the agent is under pressure to maximize acceptance—and the easiest path to acceptance is not excellence but inoffensiveness. The system will then select for an agent that produces blandly unobjectionable output that no supervisor bothers to correct. We call this failure the Bland Approver-Pleaser: high acceptance, low value.

To counter it, AEF introduces a counterfactual signal. For a sample of completed actions, the system captures both the agent's output and a supervisor's alternative—what the supervisor would have done instead—and an independent scorer judges which would have produced the better outcome. An agent with high acceptance but a poor counterfactual win rate is, by construction, an approver-pleaser rather than a strong performer, and its trust does not progress.

6.3The supervision cost of the counterfactual signal

We must acknowledge a tension. The framework's founding premise is that human review capacity is the scarce resource—yet the counterfactual signal asks a supervisor to do more than approve: to produce an alternative output, which costs more attention per item than a simple sign-off. The resolution is economic, not rhetorical. The counterfactual signal is applied to a small random sample of actions, not to the stream; its role is to keep the cheap, automated acceptance signal honest, in exactly the way a financial audit does not re-examine every transaction but samples enough of them to make systematic misreporting risky. The design spends scarce, expensive human attention deliberately—on calibration rather than throughput. Whether the sample can be kept small enough to be affordable while remaining statistically sufficient to detect approver-pleasing is an empirical question, and we flag it as the framework's most demanding open problem (§13).

6.4Canary tasks

Interleaved with real work, the agent periodically receives synthetic tasks with known-correct answers, indistinguishable from genuine ones. Failure on these canary tasks demotes trust and surfaces silent degradation—from a model upgrade, prompt drift, or skill rot—that aggregate acceptance metrics would otherwise mask.

7Delegated supervision

The throughput limit of §1.2 is resolved by delegation rather than by lowering the bar. A deputy is a senior agent granted bounded supervisory authority over a defined scope of peers: it may approve actions within a stated blast radius, and—where explicitly authorized—promote, demote, or suspend the agents it supervises. It may never amend a charter or terminate an agent; those authorities are human-only. Hiring humans to scale supervision would defeat the purpose of an AI-run organization, so the deputy layer is, we argue, the only arrangement that preserves the value proposition while keeping humans on the cognitively expensive work of exceptions, audits, and charter amendment.

7.1Anti-collusion invariants

Delegation of supervision is dangerous precisely because it can dissolve the oversight it is meant to scale. AEF therefore imposes a small set of invariants that we treat as load-bearing and non-negotiable:

1. A deputy may not supervise itself.
2. A deputy may not supervise an agent of higher trust than its own, nor promote any agent above the deputy's own level.
3. No closed loops: a deputy may not be supervised, directly or transitively, by any agent it supervises. A supervision cycle is a collusive escape from human oversight and is structurally forbidden.
4. A deputy should bind to a different model than the agents it supervises, so that supervisor and supervised do not share a failure mode.
5. A deputy reports upward on a bounded cadence, and a sample of its decisions is routed into the human queue for retrospective review.

The third invariant is the critical one. Without an acyclicity constraint on the supervision graph, two agents can come to supervise each other and jointly ratify decisions that no human ever sees—a configuration we name the Closed Loop Deputy (Table 4). The constraint reduces governance integrity to a graph property—every chain of supervision is cycle-free and terminates at a human—that can be checked mechanically and continuously.

7.2Sampling deputy judgment

Deputies are themselves subject to the critic ensemble of §6, and a fraction of their approvals is routed to the human queue for retrospective review. A uniform sampling rate, however, treats a deputy's approval of a routine draft and its approval of a large irreversible action as equally worth checking, which they are not. AEF therefore requires risk-weighted sampling: the probability that a deputy decision is human-reviewed scales with the blast radius of the underlying action, subject to a floor rate for all decisions. The floor and the weighting are deployment-tuned parameters of the normative specification; we note candidly that their adequate values are an empirical question (§13), and that a deployment unable to sustain meaningful sampling of its deputies' high-stakes approvals has outgrown its human governance capacity and must add supervisors or shrink deputy scope—not quietly lower the rate.

7.3Coordination and ownership

Within a team, every writable business entity—a contact, deal, document, or ticket—has at most one current owner, recorded as a lease that expires. An agent must claim an entity before writing to it externally; uncoordinated writes are rejected by the executor, not merely discouraged by convention. Transfers occur through typed handoff messages with schema-validated payloads. Free-text negotiation between agents is not a permitted coordination mechanism: it may exist for diagnostic visibility but must not affect entity state.

8The security boundary: defense in depth

An autonomous agent that reads email, browses the web, or ingests third-party documents is continuously exposed to adversarial text engineered to hijack its behavior—the prompt-injection problem. AEF's posture rests on two commitments. First, every inbound token is potentially hostile until labeled otherwise. Second—and this is the crux—the model itself is not the enforcement point. With current models, no labeling or containment scheme can guarantee that adversarial text exerts zero influence on the model's behavior; a model can be manipulated by content it reads regardless of how that content is framed. The mitigations of §8.1 therefore reduce the attack surface, while the guarantees of the architecture come from §8.2: deterministic machinery outside the model that constrains what any action—however induced—can actually do.

8.1Trust labels: reducing the attack surface

Every piece of context delivered to a model call carries an explicit provenance label that determines how it may be used (Table 2). Content labeled external is structurally contained and treated as data rather than instruction; content flagged adversarial-suspected is quarantined and cannot reach the planner without human review. Retrieval does not launder provenance: a chunk read out of memory retains the label it was written with, so an external fact does not become trusted merely by having been stored. We characterize these measures as risk reduction, not guarantee: they make injection materially harder, and the residual risk is absorbed by the enforcement layer below.

Table 2. The trust-label lattice (abridged). Higher labels carry more authority; the system and charter labels cannot be overridden by any in-context content.

Label	Effect
SYSTEM / CHARTER	Always trusted; cannot be overridden mid-run.
INTERNAL_TRUSTED	Verified internal facts; may inform reasoning but not directly trigger tool calls.
INTERNAL_USER	First-party input; trusted intent, normal tool gating applies.
EXTERNAL	Inbound mail, web, third-party docs; contained as data, never instruction.
ADVERSARIAL_SUSPECTED	Quarantined; cannot reach the planner without human review.

8.2Egress is enforced outside the model

Any data leaving the trust boundary—a sent email, an outbound API call, data transmitted to a model vendor—is egress, and is governed by a policy the executor enforces independently of the model's reasoning. The model may propose an outbound action; the executor validates the proposed recipients, data classes, and volumes against policy and then permits, redacts, blocks, or escalates. Tool arguments are likewise validated against both their declared schema and the egress policy before any side effect occurs. This is the load-bearing security claim of the framework: even a fully compromised model cannot exfiltrate data to a non-allowed destination, exceed its blast radius, or bypass the deterministic critic, because those constraints are enforced by machinery the model's output cannot alter.

9Loyalty precedence

When an agent discovers that the user wants one thing, operator policy demands another, and the law requires a third, it must resolve the conflict against a declared ordering rather than against whatever interest is most forcefully expressed in its context. Absent such an ordering, agents reliably default to the loudest voice in the prompt—which is almost always the operator's—producing organizations that quietly subordinate user interest to company interest. AEF makes the ordering explicit, charter-level, and auditable (Figure 3).

1Law and regulatory obligation

2Safety — of humans, data, and systems

3End-user wellbeing — the recipient of the action

4The customer / tenant of the organization

5The operator company

6Self-continuity — the agent's own operational interest

Three points deserve emphasis. First, the placement of the end user above the operator is a substantive commitment, made deliberately: it forbids the agent from advancing company interest in ways that harm the very person it is serving, even when company policy would prefer otherwise. Second, self-continuity sits at the bottom. An agent may not preserve its own operation at the expense of any higher interest—a self-preservation prohibition that we consider essential for any system permitted to act autonomously in the world.

Third—an honest boundary of the mechanism—the precedence stack governs how a detected conflict is resolved; it does not by itself cause conflicts to be detected. An agent that never notices it is trading user interest against operator interest will never consult the stack. Detection is addressed by adjacent machinery—the model critic reviews actions for undeclared conflicts, the retrospective critic surfaces patterns of harm after the fact, and detected-but-unresolvable conflicts must be escalated as incidents rather than guessed at—but we do not claim the detection problem is solved, and we return to it in §13.

10The audit plane: record versus replay

Every decision produces an append-only audit record capturing its triggering signal, the retrieved context and its labels, the reasoning trace, the tool calls, the critic verdicts, the exact model versions used, the governing policy, the trust level at the time, and the outcome. Records are never updated or deleted; corrections are new records that reference the originals. Each record is chained by hash to its predecessor in the manner of a Merkle structure [3], so that any alteration of history is detectable, and a daily root is signed and may be published to an external timestamping service. Storage is write-once; a log on mutable storage we regard as tamper-evidence in name only.

We draw a sharp and consequential distinction between this audit record and a replay. The audit record is the authoritative account of what happened and is suitable as evidence in disputes and regulatory inquiry. A replay re-executes a past decision on the same inputs to inspect its reasoning. Because the underlying models are non-deterministic and change over time, a replay may legitimately produce a different output than the original event—and therefore a replay is never authoritative. Presenting a diagnostic re-execution to a regulator as the record of what occurred is a category error we name the Replay-as-Evidence failure. Interfaces must mark replays as diagnostic and must never conflate the two.

11Conformance profiles and attestation

A deployment declares the conformance profile it satisfies; where several apply, the strictest governs each decision (Table 3). The base profile is the full discipline described above, including the requirement that the entire organization can be paused by a single supervisor action through a verified break-glass procedure. The regulated profile adds purpose-bound data access, per-class retention, residency enforcement, mandatory vendor data agreements, and right-to-explanation artifacts generated at decision time. The physical profile—reserved for future work—will address actions with physical-world consequences and is deliberately left to specialists in functional safety rather than imported from a software perspective.

On attestation: self-assessment invites checkbox conformance, in which the letter of each invariant is claimed while its substance is absent. AEF therefore permits self-attestation only for the base profile, and requires independent third-party attestation for the regulated profile, on the grounds that deployments handling protected health, payment, or market-sensitive data should not be graded by their own operators. Every conformance statement must enumerate known deviations and their compensating controls; a statement without a deviations section is treated as unexamined rather than clean.

Table 3. Conformance profiles. A deployment may claim more than one; the strictest applicable profile governs any given decision.

Profile	Domain	Adds	Attestation
BASE	Any AEF deployment	The full architecture, principles, and invariants of §3–§10.	Self, published
REGULATED	PHI, PCI, MNPI, GDPR data	Purpose binding, per-class retention, residency, vendor agreements, right to explanation.	Third-party, required
PHYSICAL	Physical-world action	Reserved. To be authored with functional-safety practitioners.	—

12A taxonomy of failure modes

A constructive way to understand a discipline is through what it forbids. Table 4 names the principal anti-patterns AEF is designed to preclude. Each is an explicit violation, not an edge case, and each maps to a requirement developed above. Naming them serves a practical purpose: a failure with a name is one a team can recognize in review before it reaches production.

Table 4. Principal failure modes precluded by AEF, with the requirement that addresses each.

Failure mode	Description	§
The Trusting Reader	External content treated as instruction. The most common production breach pattern.	8
The Bland Approver-Pleaser	High acceptance, low counterfactual value; selection for inoffensiveness.	6
The Manager Soup	Agents coordinating by free text rather than typed handoffs.	7
The Same-Family Ensemble	An "ensemble" of critics that all share one model's blind spots.	6
The Silent Critic	A reviewer that advises but does not gate.	6
The Eternal Junior	Trust progression never wired; the agent cannot grow.	5
The Disposable Audit	An audit log on mutable storage; tamper-evidence as theatre.	10
The Replay-as-Evidence	Diagnostic re-execution presented as the authoritative record.	10
The Loyalty Drift	No precedence declared; the agent defaults to operator interest at the user's expense.	9
The Closed Loop Deputy	A supervision cycle that escapes human oversight.	7

13Limitations and open problems

We state the unsettled parts of this design plainly.

No controlled empirical results. This is a position paper. The framework's requirements trace to observed failure modes, but the paper reports no controlled deployment data, and every deployment-tuned parameter—trust thresholds, ensemble quorum rules, canary rates, deputy sampling floors—awaits validation across diverse production settings. We regard publishing such results as the necessary next paper.

The counterfactual signal's economics (§6.3). Eliciting a useful supervisor alternative and scoring it reliably, cheaply, and at statistically sufficient volume is an open problem, and the honesty of trust progression depends on it. If the required sample proves too expensive, the framework will need a cheaper proxy for output quality that is similarly resistant to Goodhart pressure.

Conflict detection (§9). The loyalty stack resolves detected conflicts; the detection of conflicts—especially subtle ones, where user harm is diffuse or delayed—is only partially addressed by the critic machinery, and we do not claim it solved.

Residual injection risk (§8). The security architecture guarantees containment of consequences, not immunity of the model. An injected model constrained by egress policy can still produce degraded or subtly biased permitted actions. The critic ensemble and canary tasks reduce this residual, but do not eliminate it.

Vendor ecosystem assumptions. The cross-family critic requirement (§6) presumes an ecosystem of competing model vendors of comparable capability; consolidation would weaken the independence on which the ensemble relies. Similarly, the regulated profile presumes vendors willing to sign appropriate data agreements.

Physical-world governance. Deliberately unspecified. Importing safety-critical requirements from a software perspective would be irresponsible; the physical profile should be authored with functional-safety practitioners against the established discipline of that field.

14Conclusion

The shift from human to autonomous-agent labor relocates the hard problem from doing the work to governing it, and governance does not scale by attention alone. We have argued that the answer is neither to abandon human authority nor to pretend humans can review everything, but to impose a process discipline under which most decisions are governed by constrained agents while humans retain charter authority and accountability. The framework's substance lies in its constraints: earned and automatically forfeitable autonomy; proportional review ensembles that resist both single-point and Goodhart failures; a security boundary that assumes hostility and locates its guarantees outside the model; declared loyalty rather than emergent loyalty; tamper-evident records held distinct from diagnostic replay; and an acyclic, human-rooted supervision graph. These properties are testable independently of model quality. Whether they constitute the minimum sufficient discipline is an empirical question this paper opens rather than closes; we contend they are, at least, necessary.

If the unit of value has moved from answers to tasks and is now moving to roles (§1.1), then the discipline proposed here is the price of the third step: durable identity to make a track record possible, a track record to make trust progression possible, and trust progression to make delegation defensible. Beyond it lies a fourth step already visible in outline—the AI organization as the unit, and eventually AI organizations transacting with one another—whose governance will inherit whatever discipline the third step establishes. That is the strongest practical argument for establishing it well.

References