The Four A’s

Access is the reachability question, and it is almost always answered by accident. An agent gets a service account because that was the fastest path through the ticket queue, and inherits entitlements no human on the team holds. Nobody granted that. Nobody revoked it either.

Scoping Access means naming every system, dataset, tool and credential the agent can touch — including the ones it reaches transitively, through a tool that calls another tool. Reachability is not what the design document says. It is what the runtime permits.

Autonomy is the axis the M0–M6 maturity model measures. It runs from a system that executes a fixed script to one that sets its own sub-goals and calls its own tools across a multi-step task. Most enterprises are further up that ladder than their governance assumes, because autonomy is rarely granted — it accrues. A checkpoint gets removed to hit a latency target, and the review that would have caught it was scoped to the model, not the workflow.

Scoping Autonomy means setting the escalation threshold explicitly, in terms the business already uses: value at risk, reversibility, confidence, and precedent. Then measuring how often the threshold actually fires.

Access is what the agent can see. Action is what it can move. The two get conflated constantly, and that conflation is where blast radius hides — a system described as read-only in every design review, holding one write-capable tool because the SDK shipped it in the same client.

Scoping Action means classifying every effect the agent can produce into reversibility tiers, and putting hard limits on the tiers that matter: rate, value, counterparty, time window. Reversible actions can be tested in production. Irreversible ones have to be proven before they get there.

Every regulated firm can produce logs. Very few can reconstruct a decision. There is a difference: a log shows what the model returned, and a reconstruction shows the inputs it saw, the version that was serving, the tools it called, the threshold it cleared, and the person whose name sits on the outcome.

Accountability is the gate that converts an agent from a system you operate into a system you can defend. It is also the one that has to be designed in at the start, because a decision record cannot be assembled retrospectively from telemetry that was never captured.