Build · governed autonomy

Governed Autonomy.

Machines draft. Only earned work executes. A named person accepts it, can stop it, and owns what remains.

A proposed operating model for software agents: define their work, check each action against current conditions, and keep a named person responsible for accepting and stopping it. The worked example, Acequia, Inc., is an invented organization; these pages are a working design, not deployment results.

Why

The adversary is already here.

The threat is not hypothetical

The mission threat is not hypothetical. Nation-state, criminal, insider, and influence actors are motivated and capable. Their tools scale faster than any human approval loop. If they succeed, they hit systems, civic and mission order, and defender judgment at once.

Two familiar answers fail

Automate everything, and an unseen process becomes theater. Put a person on every finding, and the mission cannot be covered. Neither path holds at this scale, or for as long as the estate keeps running.

Threat

Motivated, capable threat actor

The mission threat profile is not hypothetical. The adversary set is broad, capable, and motivated: nation-state, criminal, insider, and influence. They use the construction and commissioning window. Who attacks, why, and when is the prerequisite for every operating decision that follows.

Threat

Exponential tools

Their tooling scales faster than a human loop. Agentic reconnaissance, exploit synthesis, lateral movement, and information flooding run at machine speed. A kill chain measured in minutes makes an approval loop measured in hours a gap, not a control. Volume is cover.

Threat

Payoff if they succeed

This is not only a compromised network. It is an attack on cyber, civil, and cognition at once. Systems and services, mission operations and civic order, defender judgment and public narrative. The payoff is compound.

Failed path

Automate everything

An unseen process cannot be automated. Unbounded agents at the mission scale are theater against an adversary who already compounds cyber, civil, and cognitive effects.

Failed path

Human in every loop

A person cannot sit on every finding and still cover the mission. Against exponential tools, an all-human loop becomes the bottleneck.

Third path

Governed Autonomy

Machines draft and, only when promoted, execute a declared class. People accept the class, interrupt, verify, and own residual risk — so the compound payoff is denied without giving the adversary a faster, dumber defender.

If they succeed they hit three surfaces at once: cyber, civil, cognition.

The third path

Governed Autonomy, in KTP's terms.

Four properties make the third path real. Each is a KTP mechanism first, and an operating rule second.

Earned

Trust tiers, and standing earned through trajectory.

A machine replays, then shadows, then recommends, then executes within bounds. Each stage needs evidence the last one produced.

The promotion ladder

Bounded

. The Trust Score, = × (1 − R), is the ceiling live conditions set.

Live conditions can only narrow what a machine may do. Emergency does not widen machines.

The Trust Score

Stoppable

The . When the action is riskier than the environment can hold, it becomes impossible, with no human in the loop.

A named person can stop any accepted class of work, and the refusal response is specified, not improvised.

What must be able to refuse

Witnessed

The . Every decision leaves a receipt with its context and reasoning.

The is never the actor; the issuer is never the . A missing witness record is inconclusive, never a pass.

The gate battery

What people keep

People keep the why, the owner, the stop, and the proof. The machine cannot write its own permission. Live conditions can only narrow what it may do.

What the platform can do, what you allow, and what a machine may do alone must stay apart. The exits, the owners, and the hard constraints must survive when product names change and people rotate. Kinds of work outlast product names; a product is one instance of that work. The tables below are that argument, written for operators.

Start here

Four readers, four short paths.

Pick the one closest to you. Each path is four pages, in the order that makes the next one make sense.

Start here if you are

Which AI risks are mine, what I can enforce, and what to tell the board.

Step 1
CISO
The not-my-risk boundary: the action layer is yours, the structural layer is shared.
Step 2
Risks
The 1,612 risks scored, and where the grip is.
Step 3
Workforce
Who accepts a class of work and owns what remains.
Step 4
Tests
What has to be witnessed before anyone cites a result.

The chapter

19 pages, three ways in.

Read the case, build it, run it. The first two are the enterprise pages; the third mirrors the Governed Autonomy workbook.

Read the case · 5

The argument, the data, the translation for security leaders, the skeptic's answers, and the method.

Build it · 4

The control sets, the rollout, the field map, and the agents that skipped the front door.

Run it · 10

How an organization operates KTP day to day: the operating model, the joins, the work, the people, the tests. Mirrored from the Governed Autonomy workbook.

Find

One search across the whole chapter.

Every mirrored section of the nine Run it pages, searched at once. A result lands on its section.

Find a term across the chapter

Search every mirrored section, from the operating model to the tests: headings, columns, rules and rows

Two characters or more.

From the workbook

What must remain true, and what this framework preserves.

The Vision tab, as written for operators: the constraints, the artifacts that last, the permissions for investigation and response (each action still faces CAN and SHOULD), the five commitments, and what the pack does not claim.

013. Three constraints — what must remain trueworkbook tab 02 · Vision

¶
Bounded
Every action has a declared class, scope, credential, rate limit, and revoke.
If missing
Without bounds, agency is a slogan.
¶
Evidence-first
No join, no assist. Unknown is not zero. Evidence is never a verdict.
If missing
Without a cross-party join, Security Operations Center (SOC), Network Operations Center (NOC), and app teams argue from different IDs.
¶
Human-gated
Promotion is earned: replay, shadow, recommend, bounded execute.
If missing
A licensed agent is not a grant. Data Analytics Provider representative enablement is not Operating Provider authority.

024. What this framework preservesworkbook tab 02 · Vision

¶
Rule of three
available platform capability != authorized operating capability != approved autonomous action
Why it lasts
Survives every SKU rename.
¶
One spine
Intake through lessons (states 0-7). Parallel playbooks overlay; they are not versions.
Why it lasts
The lifecycle remains the operating home as platforms change.
¶
Six-party join
Cyber Security, IT Operations, Application Operations, Governance, Regulatory, Compliance share IDs on the case.
Why it lasts
Extensible slots — add a party or object without opening Version 5.
¶
Promotion
Replay → shadow → recommend → bounded execute. Per action class.
Why it lasts
Agency is earned, not implied by license.
¶
Three clocks
Joint maturity. Platform train. Mission horizon. A release is not a joint version.
Why it lasts
Keeps Data Analytics Provider SIEM platform train from becoming Version 5.
¶
Named work
Operating Provider playbooks, hard constraints, and use-case/requirement IDs.
Why it lasts
Operating Provider documents remain source of record.
¶
Exits
What done means per version, and what is not sufficient.
Why it lasts
A demonstration is not an exit.

036. Two autonomy gates — platform default is not joint authorityworkbook tab 02 · Vision

¶
Investigation gate
May a machine start or close an investigation?
Joint position
Joint: V3 only, per action class, independent verify.
¶
Response gate
May a machine run a Security orchestration, automation, and response (orchestration platform) action?
Joint position
Joint V2: recommend except pre-declared low-risk. Hard constraints still bind.

047. Five commitments of the frameworkworkbook tab 02 · Vision

¶
1. Name the threat
The adversary is motivated, capable, and already in the window.
Framework move
Actor, exponential tools, payoff across cyber / civil / cognition. Then why unbounded automation and all-human loops fail.
What must remain
The justification outlasts any product name.
¶
2. One case spine
Playbooks and tickets otherwise live in parallel systems.
Framework move
States 0-7. Parallel playbooks overlay; they are not versions.
What must remain
The lifecycle remains the operating home as platforms change.
¶
3. Join the evidence
Host, service, venue, owner, journey, and field do not yet mean the same thing across SOC, NOC, app, and Governance, Regulatory, and Compliance (GRC).
Framework move
V2: a common information model/join, entity graph, service monitoring/service catalog, evidence fitness, mission schedule, GRC objects on case.
What must remain
A machine cannot assist what it cannot join; a party cannot authorize off a parallel dashboard.
¶
4. Bound the action
A licensed agent is not production agency.
Framework move
Investigation and response gates. Promotion: replay, shadow, recommend, bounded execute. Suites map onto the spine; they are not joint versions.
What must remain
Platform default remains distinct from Operating Provider authority.
¶
5. Preserve the contract
SKU names and SIEM platform releases will change.
Framework move
Rule of three, three clocks, version exits, named owners, hard constraints.
What must remain
Those rules survive trains, editions, and personnel change.

058. Invariants — this pack does notworkbook tab 02 · Vision

¶
Commercial editions
commercial editions are not joint versions. They are commercial editions.
¶
Automation percentage
This pack does not set an automation percentage as a joint target.
¶
Platform execution
Joint V2 recommends except pre-declared low-risk. Platform capability is not the default grant.
¶
Platform trains
A new SIEM platform train release does not open Version 5.
¶
Claims contract
Assumptions, non-claims, definitions, and falsifiers live on Claims & boundaries. This section is the short invariant list, not the register.

Where it is written down

The protocol, the commons, and the worked example.

KTP, the protocol

OTCS, the commons

OTCS-0017 Work TypesDRAFT · in deliberation · earliest decision 2026-11-28
OTCS-0019 Requirement profilesDRAFT · in deliberation · earliest decision 2026-12-11
OTCS-0020 Observation classesDRAFT · in deliberation · earliest decision 2026-12-11

The worked example

The Governed Autonomy workbook, v0.50: a capability matrix for an invented organization, Acequia, Inc., with 38 tabs. The Run it pages mirror its structure; its deployment rows stay with it.