Design decision rights, escalation, and recovery
This path turns the principle of matching autonomy to consequence, uncertainty, and reversibility into an operating rule. Write the escalation contract that states which signal stops the system, who takes over, and how work returns safely.
Applied output
An escalation and recovery contract turns the trigger, takeover owner, transferred context package, safe state, and restart condition into a testable operating rule.
Five clauses of an operable contract
‘Send to a human’ is not enough. The information, timing, and recovery conditions of takeover must be explicit.
- Trigger
- Which numeric threshold, low-confidence state, policy exception, or system failure stops the flow?
- Takeover destination
- Which named role accepts the work, within what response window, and with which backup owner?
- Context package
- How are decision history, sources, confidence signals, actions taken, and the proposed next step transferred?
- Safe state
- While work waits, should the system stop, roll back, isolate, or move to read-only mode?
- Return condition
- Who restarts normal flow with which evidence, and which evaluation loop receives the event?
Authority case
Should the agent publish the campaign?
A marketing agent prepares approved campaign variants and may publish them in low-budget channels. If the audience filter is incomplete, existing customers could receive an incorrect price promise; waiting for a manager on every variant would remove the speed of experimentation.
How would you layer authority?
The agent may publish only within approved audience, budget, and message boundaries. Missing segment evidence, a price change, or an unexpected complaint signal pauses publication and escalates a context package to the campaign owner. Pause, withdrawal, and re-approval conditions belong in the contract.
A usable escalation contract
Trigger
Which threshold, uncertainty, or exception makes the agent stop?
Owner and time
Who takes over, and within what response window?
Context package
Which evidence, history, and recommendation does the human need to decide?
Recovery
How do stop, rollback, safe mode, and restart work?
Learning
Which evaluation loop receives overrides, errors, and exceptions?
Common trap
“Reducing accountability to an approval checkbox on the final screen.”
Accountability requires an outcome owner, access boundaries, decision traces, intervention capacity, and regular evaluation. Approval can only be one part of that system.
Check before the final PracticeLab
Choose one action an agent could take: when may it act directly, which signal makes it stop, and how does the system return to a safe state?
Name a threshold, a human owner, a context package, and a recovery step.
Keep this
Safe autonomy is not approving everything. It is bounding authority and reliably stopping and recovering when an exception appears.