Agent lifecycle

• ·Agent specification with a named purpose and a named owner
• ·Risk classification recorded in the agent risk register
• ·Data access scope reviewed and narrowed to what the purpose needs

A human reads every output because nothing else does. more

There is nothing below propose. more

• ·Shadow run log covering at least 500 live units
• ·No-write attestation from the platform, signed by the platform owner
• ·Agreement rate against the incumbent path, by unit type

The incumbent path remains authoritative. more

Agreement below 80 percent over a rolling 14 days returns the agent to propose and voids the shadow log … more

• ·Golden test set defined and the first evaluation run recorded
• ·Override capture wired so every human correction is stored as a case
• ·Human queue capacity confirmed against forecast volume
• ·Rollback path written down and owned

A named human approves each release and every override is captured as a labeled example, which is where most of the golden set comes from.

Override rate above 25 percent over 14 days, or a failed evaluation run against the held-out set, returns the agent to shadow automatically.

• ·Evaluation at or above the promotion floor on a held-out set the agent has never seen
• ·Adversarial test executed against this agent with no unmitigated high finding
• ·Rollback rehearsed on the line, with a measured time
• ·Blast-radius cap set for any change affecting this agent
• ·Service level attached with a named counterparty

A sampling plan with a stated sample rate, an exception queue with an owner, and an override log that is read rather than merely written.

Two priority-one exceptions in a class this agent owns within 30 days, or an evaluation score below the floor, returns it to supervised automatically and notifies the function leader.

• ·Independent evaluation review by someone outside the team that built the agent
• ·Ninety days at delegated with the full override record intact
• ·Kill switch tested on this agent, with a date and a measured stop time
• ·Named owner for every exception class this agent can raise
• ·Executive sign-off recorded against the accountable function leader

Periodic re-evaluation on a fixed calendar, an exception taxonomy with named owners, and a kill switch that has actually been pulled in a drill rather than merely wired.

Any single priority-one exception attributed to the agent, an evaluation regression beyond the tolerance band, or a service-level breach attributed twice in a quarter returns it to delegated automatically.