gov-autonomous-execution-policy

To set up autonomous execution boundaries, you must verify five preconditions: sandboxed mode, documented execution profile, externalized credentials, configured audit path, and human-reviewed approval stories. You then write the execution-profile.yaml to enforce these boundaries.

Transitioning to sandboxed autonomous execution requires verifying the implementation phase, documenting execution profiles with filesystem and network scope, externalizing credentials, and configuring audit evidence paths before enabling autonomous modes.

No, you cannot enable autonomous execution without a human-reviewed approval story. You must create and approve a HUS-* story recording the desired approval_mode and execution_mode to ensure every autonomous run is reviewable and reversible.

Audit evidence for unattended AI runs must be recorded at a configured audit path. This evidence ensures every autonomous run is reviewable and reversible through story-based governance, satisfying the sandboxed execution mode verification.

You configure restricted-autonomous scopes by creating the execution-profile, recording an approved HUS-* decision, and configuring runtime audit recording before enabling restricted-autonomous tasks for CI-like sandboxed runs.

The limitation is that certain operations must always remain human-gated, even in sandbox-autonomous scopes. You must maintain externalized credentials out of Git and ensure all preconditions are met before autonomy is enabled.