Original Framework · 2025–2026
Trust between humans and AI agents has to be earned through evidence - not assumed, not delegated, not hoped for.
The Shift
When AI produced text, governance lived at the output - review, approve, move on. That model made sense. The AI was a fast writer. You were still the decision-maker.
But agents now execute across live systems. They call APIs, move money, hand off work to other agents in loops their operators can't fully see. The attack surface moved with them: prompt injection lives at the semantic layer, where firewalls and pre-deployment checklists don't reach.
And the moment that shift happened, the confidence teams felt about their AI systems stopped being proof of safety and started being a symptom of how much they couldn't see.
The Gap
The answer the industry converged on is sound: graduated autonomy - small authority for low-stakes actions, human approval for irreversible ones, runtime monitoring in between. That principle isn't wrong. It's just not enough.
Because a principle without a proof is just a policy. And most teams deploying agents today cannot show you, row by row, what their guardrails actually cover - or which capabilities their agents earned, versus which ones were granted on faith.
"Autonomy isn't granted. It's earned, one rung at a time."
This framework closes that gap. Every agent capability traces to an evidence chain: the research behind it, the requirement it serves, the guardrail watching it, the human who approved it. The ladder only holds if every rung was built on something real.
The Two Ladders
Graduation looks different depending on how the agents are orchestrated. Sequential systems earn trust at the handoffs. Magentic systems earn it at decisions. The evidence architecture is universal - what changes is where in the flow the agent has to prove itself.
Two Ladders, Two Shapes
Same evidence architecture. Different point where the agent has to prove itself.
Sequential - Fixed Path
Path known in advance. Graduation happens at each handoff - B only proceeds once A's output clears entry criteria, across enough cases. The audit trail is the path itself.
Magentic - Discovered Path
Planning autonomy
Delegation autonomy
Graduation happens at decisions. Two gauges, not one - earned separately.
Sequential Pattern
Trust at the handoffs
The path is known in advance. Agent A passes to B passes to C. Graduation happens at the handoffs - each agent earns more autonomy by producing outputs that pass the next agent's entry criteria across enough cases. Guardrails watch the outputs. The audit trail writes itself because the path is fixed.
Magentic Pattern
Trust at the decisions
The path is discovered during execution. A manager agent interprets the goal, picks specialists dynamically, replans mid-flight. Graduation happens at decisions - the manager earns autonomy by making planning choices that match what a human orchestrator would have decided, within an acceptable delta, across enough cases. Guardrails have to watch the planner, not just the outputs.
The manager earns two gradients, not one. Planning autonomy - how much it can decide without human review - and delegation autonomy - how much it can trust child evidence without re-validation. These decouple for good reason. A manager might be trusted to plan well but not trusted to consume unfamiliar child outputs without a gate. The framework treats them separately because the evidence requirements for each are genuinely different.
The Autonomy Ladder - Evidence Required per Rung
The Hybrid Boundary
Most production agent systems aren't cleanly Sequential or cleanly Magentic. They're hybrid: a Magentic manager delegating to Sequential sub-pipelines. This is where governance gets hardest - because authority flows in a direction the system wasn't designed to anticipate.
Indirect authority paths are the core vulnerability. The Sequential pipeline's evidence directly informs the Magentic manager's probabilistic decisions. The manager can't self-police the data it receives. Evidence flowing across orchestration boundaries carries authority it was never scoped to have - and authority without provenance is how agent systems compromise themselves.
Compaction loss is the quiet failure mode. Context windows fill fast. Sub-pipeline output has to be summarised before it reaches the manager. By the time the manager acts, the evidence chain behind its decision may be three compaction steps removed from the original signal. Most observability tooling captures what the agent saw. Almost none captures what the agent didn't see because it got compacted away. That asymmetry is where hybrid systems fail silently in production.
The Hybrid Boundary
Same evidence scale. Watch it degrade on the way up.
3 compaction steps, one star lost each time - unflagged, this is where it silently ends up
Evidence originates here - Sequential sub-pipeline
Evidence flowing up carries authority it wasn't scoped to have - and by the time it crosses three compaction steps, it can be flagged ∅ Assumed on the same scale that governed it at the source. The guardrails sit at the boundary itself, not inside the manager and not inside the pipeline. That's what "decoupled" actually looks like.
Decoupled enforcement
Guardrails operate independently of the manager's reasoning layer. Security controls don't live inside the agent they govern - because the moment they do, the agent can argue its way around them. Decoupling is structural, not configurable.
Comprehensive auditability
Every tool call, data access event, and input across child pipeline and parent manager is recorded - with retrievable provenance preserved across compaction events, not just the compacted summary. Most observability tooling captures what the agent saw. Almost none captures what got compacted away.
Real-time risk scoring
Behavioural anomalies and policy drift detected in flight, scoped to trigger defined responses - rollback, escalation, or hard stop - at pre-set thresholds. The agent doesn't get to decide when a threshold matters. The framework does, before deployment.
Position vs. the Seven Pillars
The seven standard enterprise guardrails are already well-documented. They answer "what do you control?" What they don't answer - and what this framework does - is when each one can safely relax, and how you'd know.
The guardrails tell you what to control. This framework tells you when control can loosen - and how you'd know. Different questions. Different tools.
Forrester's AEGIS
Governs what the guardrails are. A pillar catalogue for the enterprise governance layer.
Graduated Autonomy
Governs when they can safely relax, and how you'd know. The evidence layer above the guardrails.
The contribution is the evidence architecture, not another pillar catalogue. Every agent capability - whether it lives in a Sequential handoff or a Magentic delegation - maps back to the same evidence chain structure. This is what keeps the two-ladder model coherent: one source of truth, both orchestration patterns read from it and write to it.
// Autonomy Evidence Chain Schema AGENT-ID // Sequential: node ID; Magentic: delegation ID Capability // The action. Irreducible. Not the implementation. Authority-Level // NONE / LOW / MEDIUM / FULL Evidence-Chain // requirement → research → guardrail → human approval Guardrails[] // Identity / Data / Action / Tool-Use / Autonomy / Behavioural / Observability Approval // Human approver + date + evidence snapshot at approval Compaction-Flag // TRUE if evidence crossed an orchestration boundary Planning-Autonomy // Magentic only - decoupled from delegation autonomy Delegation-Autonomy // Magentic only - trust in child output provenance Status // Earned / Pending / Revoked / Under-Review
The Compaction-Flag is the field most governance schemas don't have. It marks every row where the evidence behind a decision crossed an orchestration boundary - meaning it was summarised before the manager received it. Flagged rows require provenance verification before any autonomy expansion. Small field. Large accountability surface.
The Honest Cost
Graduated Autonomy makes Magentic workflows slower and more expensive, because evidence collection at every planning decision is real overhead. Retrievable provenance across compaction events costs storage and retrieval latency. Decoupled enforcement means running guardrail infrastructure separately from agent infrastructure.
The honest positioning isn't use this framework and get governance for free. It's pay the governance cost upfront and visibly, instead of paying it later and invisibly when something goes wrong.
"You're not choosing between cost and no-cost. You're choosing between a cost you can budget for and a cost that arrives as an incident at 2 a.m. on a Saturday."
The thing I'd defend most: decoupling planning autonomy from delegation autonomy. There's a consistent temptation to treat them as one gradient - either the manager is trusted or it isn't. But a manager can be excellent at planning and unreliable at consuming unfamiliar child outputs. The framework splits them because the evidence requirements are genuinely different. That split is the part that takes the most explaining, and the part I'd least want to simplify away.
What Changes
If the framework takes hold, the shape of agent governance flips in three places. Each reversal is small by itself. Together they relocate where the burden of proof sits.
Granting autonomy by policy decision.
Start granting it by evidence threshold. The threshold is defined in advance. The evidence is retrievable after the fact.
Treating governance as deployment-time sign-off.
Start treating it as a runtime evidence loop. The discovery cadence doesn't end when the agent ships - and neither does evidence collection.
Governing child pipelines and parent orchestrators with the same instrument.
Start decoupling them. Governance burden flows upward across orchestration boundaries - not downward, as intuition suggests.
Three things aren't yet proven - and the framework says so on its own page. The name. "Graduated Autonomy" hasn't passed the recall test with three independent practitioners; until it does, it's a working title with strong signal, not a settled one. The adoption claim. Whether this evidence architecture meaningfully changes post-incident rates in teams that adopt it versus teams that don't has no comparative data yet - the framework's own RTM names it as ∅ Assumed. AEGIS. Forrester's framework operates in the same enterprise guardrail space; the distinction is clean - AEGIS governs what the guardrails are, Graduated Autonomy governs when they can safely relax - but the overlap is real, and it's named here rather than hidden. If the thesis is that trust has to be earned through evidence, this page can't be the place that violates the thesis.
The Declaration
The ladder only holds if every rung was built on something real - and this framework is how you build it.
Graduated Autonomy · A Traceability Framework for Agentic Orchestration · Nguyen Le · 2025–2026