Autonomy Without a Demotion Path Is Permission Creep

Ask a team how their agent earns more autonomy and you’ll usually get a good answer; reliability earns the rung has won the argument. Then ask the other direction: under what observation does this agent lose a rung, who executes that, and what exactly happens in the next ten minutes? In the deployments I’ve reviewed, that’s where the answers stop, or collapse to “we’d turn it off,” which is not a demotion path. It’s the absence of one, wearing a decisive face.

The gap matters because of what an unexpired grant becomes. Every autonomy grant is made under the conditions of its moment: a model version, a traffic mix, a dependency’s behavior, a context feed’s freshness . Any of those can drift, and a grant with no expiry, no tripwire, and no demotion trigger preserves yesterday’s authority after yesterday’s evidence has expired. That’s the ratchet. Not that permissions mystically accumulate, but that nothing you built subtracts them. Security teams call the human version permission creep and answer it with expiry and review, never with trust.

The kill switch doesn’t close the gap, and here the point needs care, because you absolutely need one. The problem is pricing. When the only step below “autonomous” is “off,” every intervention costs a full stop: workflows halt, humans absorb the load cold, a war room convenes. A control priced like an outage will be reserved for outages. So the early signals that should have triggered a quiet step-down accumulate instead, until something forces the button. You still need the kill switch. But if “off” is the only way down, you have an emergency control, not an operating model.

The operating model is a transition contract per rung, written next to the grant it mirrors, four clauses.

Trigger, with control-engineering hygiene, or you trade the ratchet for thrash. Quality triggers need a defined failure, a denominator, a minimum sample, and hysteresis: escape rate over the bar across enough volume to mean something, with a dwell time before re-promotion, scoped to the affected workflow rather than the fleet, and capped by what the fallback path can absorb. Two kinds of events skip the debounce entirely. A boundary breach, meaning any action outside the declared lane, harmless or not, doesn’t step down a rung; it halts that capability pending human requalification, because a lane violation is evidence about the boundary, not the quality curve. And a model change: scheduled vendor releases should qualify in shadow or canary before cutover, so they never demote anything, while an unexpected or unverifiable change under a workflow drops it to supervised until your evals re-clear it. The vendor’s changelog is not a qualification; your shadow run is.

Authority: who executes a demotion. The set must include the on-call engineer and the automation itself, no meeting required. Promotion can be a committee; demotion can’t wait for one. No meeting does not mean no rehearsal, which is the third clause’s job.

Mechanics: what stepping down physically means, rehearsed like a restore. Atomic permission reduction, so there’s no window where the old credentials outlive the decision. Drain-or-cancel semantics for in-flight actions, decided per action class in advance. A bounded approval queue at the lower rung, with load-shedding rules for when supervised mode can’t absorb the volume. And a measured transition latency, the minutes from trigger to the agent verifiably operating at the lower rung, tracked, because an unrehearsed control is a hope with a runbook.

Re-entry: the exact eval set, observation window, model and config identity, and named approver that restore the rung. Without this clause demotion becomes exile, teams fight to avoid it, and you’ve rebuilt the hesitation you were removing. With it, demotion changes social meaning. Not an incident: maintenance. The triggers fired, the on-call stepped the workflow down, it degraded gracefully to drafts-for-approval, re-qualification is scheduled. Four sentences in a weekly review.

Boards have learned to ask who can halt the machine . The better audit is one rung down: show me the last demotion that wasn’t an emergency. If there’s never been one, autonomy in your shop only moves in one direction, and you already know what that’s called.