The orchestration chain
User intent → context → orchestrator → policy check → agent selection → data permission → tool permission → human confirmation when required → action → verification → audit. Agents do not receive unlimited access merely because they belong to one ecosystem.
L0–L5 human approval ceiling
L0 Observe/Read. L1 Recommend. L2 Prepare drafts/plans. L3 executes only low-risk reversible actions when policy specifically allows it. L4 consequential actions require human confirmation. L5 is restricted to human/admin/qualified-professional authority for professional judgment, clinical decisions, high-risk financial authority, irreversible destructive action, and sensitive administration.
Classification does not grant permission
An approval level is a ceiling, not an authorization token. A workflow still needs a specific allowed purpose, owner authority, data scope, tool scope, status, risk decision, and evidence that the action is appropriate.
Every AI system needs a contract
Minimum record: AI ID/name/version, purpose, owner, status, allowed actions, prohibited actions, data access, memory access, tool access, source policy, model/provider, fallback, human/professional review requirement, risk classification, logging/retention, kill switch, public status, evaluation/test set, last review, and evidence.
Event does not equal permission
An event may request a workflow; policy decides whether it may proceed. A service request, profile change, overdue task, or expired evidence may trigger checking and preparation, but not free autonomous action.
Verification and safe failure
Meaningful execution should end in result → evidence → verify → accept/correct → learn. Consequential AI/automation must be disable-able. Fallback may be deterministic/manual flow, queued human review, provider fallback, correction + audit, output blocking, rollback, or retained request + notification.
Reflection
Questions to sit with
- What approval level is this action, and who actually owns the authority?
- What exact data and tool permissions are necessary—nothing more?
- How can the action be verified, corrected, rolled back, or stopped?