Automate the boring, gate the irreversible.
That's the whole framework. Here's how we use it to decide what an AI system may do on its own.
Ask four questions about every action:
1. Is it reversible? Drafts, internal notes, staging changes, tagging, and summaries are cheap to undo. Sends, payments, deletions, and public posts are expensive or impossible to undo.
2. Does it leave the building? Anything external (customers, partners, public channels) carries reputational and legal weight that internal actions don't.
3. What's the blast radius? One record or a bulk update. One recipient or a whole list.
4. How verifiable is it? If code can check correctness (schemas, business rules, totals), autonomy goes up. If only judgment can, it goes down.
Then sort each action:
Autonomous: reversible, internal, small blast radius, verifiable. Let it run and log everything.
Autonomous with checks: reversible but wider impact. Validate in code and review samples after the fact.
Gated: irreversible, external, or bulk. The agent prepares everything, a human sees the exact payload, and one click approves.
Never: actions that shouldn't exist as tools at all.
Two common mistakes. Gating everything, so humans rubber-stamp and the gate stops meaning anything. And gating nothing, which works right up until the one call that matters.
Done right, the agent carries the routine work and people spend their attention only where it counts.