Authority and policy

ExplorerCopy Anchor Link

1apiVersion: numinance.dev/v1
2kind: AutonomyPolicy
3metadata: {name: org-ladder, scope: SCOPE_ORG}
4spec:
5  defaults: {level: AUTONOMY_LEVEL_PR}
6  rules:
7✓    - {match: {playbook: dependency-upgrade, risk: RISK_CLASS_LOW}, level: AUTONOMY_LEVEL_MERGE} (matched)
8  floors:
9    rules:
10      - {match: {risk: RISK_CLASS_HIGH}, max_level: AUTONOMY_LEVEL_SUGGEST}
11      - {match: {environment: production}, max_level: AUTONOMY_LEVEL_MERGE}

Decision pointCopy Anchor Link

Before any privileged action the runtime asks a policy decision point, outside the model, for a decision of allow, deny or require approval. The input names the action and its risk, the actor and its kind, the change and its state, the autonomy level and floor, residency, remaining budget, present and required evidence and the digests of the profile, policy and plan. The result carries reasons, obligations such as extra evidence or dual control, approver constraints that exclude the author, and a decision identifier recorded in evidence. Floors are evaluated first and default to deny. Policy bundles are signed and verified at load; customer floors cannot be overridden by lower scopes.

Autonomy ladderCopy Anchor Link

The ladder is AUTONOMY_LEVEL_OBSERVE, _SUGGEST, _IMPLEMENT, _PR, _MERGE, _STAGE, _RELEASE and _OPERATE. A level is set per scope with inheritance and floors. Promotion is proposed from qualification statistics and accepted by a human; it is never automatic. The sandbox profile of the host also caps the effective level.

GrantsCopy Anchor Link

A grant derives capabilities, resource scope, budgets, residency class, environment scope and expiry from the profile, playbook step, risk and level. It is immutable. A run can request a narrower grant for a sub-step and never a wider one. Every capability call and credential handle references its grant.

Capability brokerCopy Anchor Link

The broker converts a grant plus a plugin's credential intent into the minimum material for one step: short-lived scoped sessions, or an injection rule for the egress proxy so the sandbox never sees bearer material. Handles expire with the step and are revoked on completion or breaker trip. The model never receives reusable credentials.

Four identitiesCopy Anchor Link

The runner (PRINCIPAL_KIND_RUNNER) writes evidence and holds no customer credentials. Break-glass (PRINCIPAL_KIND_BREAK_GLASS) is a named human, time-boxed, and impossible for any agent identity to invoke.

Policy denies an approver that equals the author, or that shares the author's run, structurally. Only the release pipeline deploys; deploy credentials are absent from the coding sandbox.

Circuit breakerCopy Anchor Link

The breaker has four positions: full automation, PR only, read only and stopped. It can be tripped by a human, an incident detector, budget or policy anomalies, an evidence-write failure or provider drift. Effects: revoke handles, pause at the next checkpoint, cap effective autonomy, record evidence. Reset needs a human and a reason. It runs in the customer runtime with no control plane dependency.

Boundary tableCopy Anchor Link

Failure casesCopy Anchor Link

• Agent asks for a tool outside its grant: denied and recorded as TOOL_DENIED.
• Budget exhausted: pause and escalate.
• Approver equals author: decision refused.
• Policy bundle fails signature verification: load fails closed.