decision-policy

An autonomous decision policy differentiates between agent-led actions and those requiring user approval by classifying decisions, scoring risk using an escalation matrix, and enforcing rules for high-risk operations. Low-risk reversible actions proceed automatically.

Risk assessment evaluates pending decisions against dimensions like blast radius, reversibility, cost, and data sensitivity using an escalation matrix. High-risk or irreversible operations trigger mandatory user approval, while low-risk actions proceed autonomously.

Enforcing escalation gates requires categorizing destructive actions and routing them through a risk assessment matrix that mandates explicit user confirmation. This prevents irreversible damage by stopping high-risk security or data modifications without approval.

Yes, an audit log records the decision, rationale, risk scores, and outcome for every classified action. This captures the full context of agent autonomy and escalation enforcement for later review.

User approval is needed when an agent modifies security configurations or performs costly operations that score high on the risk assessment matrix. Actions with high blast radius, data sensitivity, or irreversibility always trigger explicit escalation gates.