Chapter 17. Autonomy Change and Its Detection
The rule that autonomy increases require re-authorization, its deliberate narrowing, and the unresolved tension that narrowing created.
17.1 The rule and its narrowing
The original rule was absolute: any autonomy increase is a Major change, always, re-entering risk classification and both G2 and G4.
That rule was narrowed during revision to apply to boundary-widening changes only — changes that expand what the agent may do, not changes within an already-approved boundary. The reasoning was practical: treating every configuration adjustment inside an approved envelope as a Major change made agentic systems ungovernable in practice, and a rule that cannot be followed is not followed.
The narrowing is logged as an unresolved trade-off, not a settled improvement. It reopens a gap that audit sampling is expected to cover, and the interaction between the two has never been tested. You are adopting a control whose designers explicitly flagged uncertainty about its calibration.
17.2 What counts as boundary-widening
Table 45.
| Change | Boundary-widening? | Classification |
|---|---|---|
| New tool added to the allow-list | Yes | Major |
| Existing tool’s action limit raised | Yes | Major |
| Existing tool’s action limit lowered | No | Minor |
| Human-in-the-loop removed from a path | Yes | Major |
| Escalation threshold raised | Yes | Major |
| Escalation threshold lowered | No | Minor |
| New counterparty added to an approved list | Yes | Material to Major by blast radius |
| Agent invoked by an additional agent | Yes, if composite authority grows | Major |
| Model swapped inside an unchanged boundary | No, on autonomy grounds | Per model-change rules |
| Rate limit increased | Yes, if it enables materially greater aggregate effect | Material to Major |
The asymmetry is deliberate. Reducing authority is safe by construction and should not carry governance friction; expanding it is the thing being controlled.
17.3 Making increases detectable
A prohibition whose violation cannot be detected is not a control. Three mechanisms make autonomy expansion visible.
Machine-readable boundaries at G3. The recorded boundary must be in a form comparable against live IAM and tool configuration. Without this, detection depends on someone noticing.
Continuous comparison. The Control Plane compares an agent’s live permission set against its G2-approved boundary. Divergence is a Security or Configuration drift signal with a specific, high-value meaning.
Verification latency ceiling. Post-action verification must occur within a defined maximum interval, scaled to tier. For a Tier 4 agent acting continuously, a weekly reconciliation is not verification.
[Practice recommendation] Treat any detected divergence between an agent’s live permissions and its approved boundary as an incident rather than a drift finding, regardless of whether the expansion looks benign. The alternative — triaging each case on merit — is how boundaries erode, because each individual expansion is usually defensible.
17.4 What remains unsolved
Two gaps are worth holding in view as you operate agentic systems.
Cumulative exposure. Many sub-threshold actions accumulating between verification cycles are not governed (Chapter 13, §13.4). Compensate with aggregate limits.
The narrowed rule’s interaction with sampling. Whether boundary-widening-only classification, backed by audit sampling, catches as much as the original absolute rule is unknown. [Practice recommendation] Until evidence exists, weight your Tier 3–4 audit sample deliberately toward agentic systems and toward changes classified as within-boundary. If that sample keeps finding misclassified expansions, revert locally to the absolute rule for agents and record why.