Why We Published Our Autonomy Model Instead of Keeping It

Any vendor can draw a ladder of autonomy levels and place its product reassuringly near the bottom. The diagram costs nothing to produce and nothing to abandon, and a reader has no way to tell the difference between a model that governs engineering decisions and one that governs a slide.

So we published ours. The levels, the invariants, the trust lifecycle, the machine-readable policy format and a working reference implementation are an open specification under Apache-2.0. You can read exactly what we hold ourselves to, and hold us to it.

Layered autonomy scales have been formalized repeatedly for five decades. Sheridan and Verplank defined a ten-point scale in 1978; Parasuraman, Sheridan and Wickens generalized it in 2000 into a matrix where automation applies independently to four classes of function. SAE J3016 made the L0 to L5 notation famous for driving. IBM's autonomic computing initiative built the equivalent ladder for IT operations in 2001. TM Forum built one for telecom networks in 2019.

Our specification names all of them and maps itself against them, because the alternative — presenting a familiar structure as an invention — is the kind of claim that collapses the moment a well-read reader arrives.

Predecessor frameworks grade capability: how much the machine does, or how little the human is involved. Ours grades something else — who authorized the action. Nobody needed, for observing and explaining. A human, per action. Or an explicit, versioned, expiring policy.

The question is never whether a system can act. It is who delegated the authority to act. A system perfectly capable of executing a change, but without authorization for it, sits at the recommendation level however sophisticated it is.

One practical consequence, and the reason the specification spends a section on it: a bare level number is not portable between frameworks. Our L5 corresponds roughly to TM Forum's L4, because we make knowing, observing and diagnosing explicit levels where they spread those across dimensions instead.

IBM's third rung, Predictive, is defined as the system recommending and the staff approving and initiating — which lands on our L3 to L4 boundary, not on our L3. So never cross-quote a level without naming the framework, and when comparing two systems' claimed levels, compare what each framework grades before comparing the numbers.

An open license means anyone can use the model, including people building something that competes with us. That is the cost, and it is real.

The return is that a customer evaluating whether to let software touch a production database can read the rules rather than trust a summary of them — including the section that lists the cautions applying to our own work. A model that only its author can inspect is a marketing artifact. One that a skeptic can audit is an argument.