Every agent action belongs in one of four zones, defined not by what the action does but by what it would take to undo it. The zone determines the policy, full stop.
Examples
Default policy
Full autonomy. No approval gates. Log and move on.
Examples
Default policy
Autonomous within rate & volume budgets. Easy rollback path required.
Examples
Default policy
Pre-flight validation required. Human-on-the-loop. Two-person rule for high-value actions.
Examples
Default policy
Human-in-the-loop required. Agent proposes; human commits. Always. No exceptions.
Architect's discipline: map every tool an agent can call into a zone, before you ship. The zone — not the agent's confidence score, not the model's capability — sets the gate. Confidence scores can be wrong; zones are a property of the system, not the model.