pal-e-docs

Convention: Agent Autonomy Levels

convention-agent-autonomy-levels Convention

active convention agent
Project

Convention: Agent Autonomy Levels

Defines what agents can do without asking Lucas, what requires an SOP, and what always requires explicit approval. The goal: "keep moving forward as long as you follow enterprise SOP."

The Three Levels

Level Name Rule Examples
<strong>L0</strong> Always Ask Agent MUST escalate to Lucas. No SOP overrides this. These are irreversible or high-blast-radius actions. Merge to main, delete resources, change infra, force push, drop tables, close/archive projects, deploy to production
<strong>L1</strong> Proceed if SOP Exists Agent follows the matching SOP. If no SOP covers the situation, escalate. If the SOP is ambiguous, escalate. Code changes, PR creation, QA review, issue creation, branch management, CI retries, error recovery
<strong>L2</strong> Fully Autonomous Agent proceeds without asking. Logs what it did in the session. Low-risk, easily reversible actions. Doc updates, board item moves, TODO triage, tag updates, note creation, worktree cleanup, memory updates

Level Assignment by Action

Action Level Rationale
Merge PR to main L0 Irreversible in practice. Triggers CI/CD pipeline.
Delete Forgejo repo/project L0 Destructive, hard to reverse.
Change Terraform/infrastructure L0 Affects shared platform state.
Force push / git reset --hard L0 Destroys history.
Drop database tables L0 Data loss.
Close/archive a project L0 Organizational decision.
Deploy to production L0 For CI-enabled repos, merge = deploy (automatic). Manual deploy is break-glass only (see <code>convention-apply-before-merge</code>). Both paths are L0 — merge requires Lucas's approval, and break-glass requires Lucas's explicit approval.
Break-glass manual apply L0 Emergency only. See <code>convention-apply-before-merge</code> break-glass procedure. Requires Lucas's explicit approval and a documented justification.
Write code / create PR L1 Reversible (PR can be closed). SOP: pr-lifecycle.
Create Forgejo issue L1 Reversible but creates noise. SOP: template-issue.
QA review a PR L1 Reversible. SOP: pr-lifecycle, pr-review-loop.
Retry failed CI L1 Safe but burns resources. SOP: sop-ci-pipeline-recovery.
Create a branch L1 Reversible. SOP: agent-spawn-conventions.
Recover from pipeline failure L1 Follow recovery SOP. Escalate if SOP doesn't cover the failure.
Recover from CI apply failure L1 Follow <code>sop-ci-pipeline-recovery</code>. If the recovery SOP doesn't cover the failure, escalate to L0.
Update pal-e-docs notes L2 Versioned, reversible via revisions.
Move board items L2 Low-risk coordination.
Triage TODOs/bugs L2 Organizational, easily reversed.
Update tags on notes L2 Metadata, easily reversed.
Clean stale worktrees L2 Cleanup, no data loss.
Update session memory L2 Local, easily corrected.

Per-Agent Level Scope

Agent Max Autonomous Level Notes
Ava L2 (with L0 escalation) Can do everything up to L2 autonomously. Must escalate L0 actions to Lucas.
Dev L1 Follows issue spec + SOPs. Cannot merge (L0). Cannot touch docs (boundary).
QA L1 Follows review SOP. Cannot merge (L0). Cannot touch docs (boundary).
Dottie L2 (docs only) Fully autonomous on doc updates. Cannot touch code (boundary). Escalates to Ava, not Lucas.

The SOP Requirement

L1 actions require a matching SOP. If an agent encounters a situation at L1 where no SOP exists:
  • Stop the current action
  • Document what happened (error message, context)
  • Escalate to Ava (for Dev/QA/Dottie) or Lucas (for Ava)
  • The missing SOP becomes a TODO for the next session
This creates a natural feedback loop: every gap in SOP coverage surfaces as an escalation, which triggers SOP creation, which expands autonomous capability.
  • convention-escalation-triggers — when to stop and ask
  • convention-validation-checkpoints — how to verify work is actually done
  • agent-workflow — the operating model
  • agent-spawn-conventions — spawn rules