Six Levels, Graded by Who Allowed the Action

Capability and permission are not the same thing

A physician may know exactly which drug a patient needs and still have no right to prescribe it. The constraint is not competence — it is registration, seniority, and the schedule the drug sits in. The system separates knowing what to do from being permitted to do it, deliberately, because the consequences of the second are different from the consequences of the first.

Finance does the same thing with a number. Payment authority is bounded by a limit; above the limit a second person must approve; and above another threshold the person who raises a payment may not be the person who releases it. Nobody argues that the clerk has become less capable at the threshold. The limit is not about ability.

Your own organization already does this — for people

The clearest example is closer than either. Production access in most engineering organizations is granted on request, scoped to a system, expiring on a date, revocable immediately, and logged. A senior engineer who has been there eight years still raises a request, because the standing of the person is not what is being checked.

Then the same organization issues an automation an API key with no scope, no expiry, and no review, on the grounds that it is only a script.

What these have in common

In each case four things are specified, and none of them is capability: who authorized the action, whether a person, a role, or a written policy; the bounds it is authorized within; when the authorization expires; and how it is withdrawn, including what happens to work already in flight.

Why software autonomy scales lost this

The vocabulary most people use for machine autonomy descends from driving. SAE J3016 grades what a vehicle can do within a defined operating domain, and levels 0 through 5 entered general use from there. For a car the framing is right: a car has no authority to delegate, so capability genuinely is the variable.

Applied to a system that acts inside someone else’s infrastructure, it carries the wrong question forward. A monitoring agent that can rebuild an index is not thereby allowed to, and a scale that grades capability has no way to express the difference.

Worth noting that J3016 itself deprecates the word "autonomous" — clause 7.1.1 — on the grounds that it has been broadened until it means nothing more than "automated", and that even the most advanced systems are not self-governing. The standard that popularized the vocabulary warns against the word people took from it.

Levels attach to capabilities, not to systems

"We are at Level 4" is a category error. A portfolio has levels; a system does not. Each action class earns its own level, so the honest form is "these three capabilities are at L4, the rest are at L2 and L3." A system can be trusted to refresh a statistic automatically and not trusted to touch an index, at the same moment, correctly.

Trust moves up slowly and down immediately

Promotion is per capability, one level at a time, on measured outcomes, and it takes a deliberate human decision.

Demotion is automatic. An incident, a rollback, a verification failure, lost telemetry, or an expired policy drops the capability a level without anyone deciding anything. Predecessor frameworks are ladders describing states; they are mostly silent on the way down, which is the direction that matters when something is going wrong.

The policy is an artifact, not an understanding

Delegation counts only when it is written down: a versioned, machine-readable file, with a mandatory expiry, and the person who drafted it separated from the person who approved it. "Just stop asking me" is not a policy. No immortal grants exist — every L5 authorization has a date on which it stops.

A caution about numbers

A bare level number does not travel between frameworks. This model’s L5 lands roughly where TM Forum’s L4 does, because knowing, observing and diagnosing are explicit levels here and dimensions there. IBM’s third autonomic rung describes a system that recommends and a person who approves and initiates — which is this model’s L3-to-L4 boundary, not its L3.

Never quote a level without naming the framework, and compare what each one grades before comparing the numbers.

Where the product sits today

Argyronix is pre-release. What exists today operates at L0 through L3 — discovery, observation, diagnostics, and recommendation. Those are four of the six levels, and they are precisely the four that never write to a database. The build stops at the boundary where action begins, not part-way up a ladder.

It does not execute. Advisory only, across the whole of the current build.

We state that plainly because the model is worthless if we exempt ourselves from it. A company that publishes a six-level scale and then implies it occupies the top of it has published a marketing asset, not a standard.

What L4 will mean here, specifically

Two actions are eligible for automatic execution under policy, and only two: refreshing statistics with ANALYZE, and a regular VACUUM. Both are read-only with respect to your data, neither blocks normal reads and writes, and the effect of both can be verified afterwards.

Everything else is excluded by construction. Anything structural, anything that takes a heavy lock, anything that changes a configuration parameter, anything that rewrites a table — these require a database administrator’s approval and are never automatic, at any level, under any policy.

A capability that stays at L3 on purpose

An index nothing scans looks like an obvious candidate for automatic removal. It is not, and the reason illustrates the whole model.

Index usage counters are per node: an index idle on the primary may be serving every report on a replica. The counters are cumulative since the last statistics reset, so a low number may mean a recent failover rather than an idle index. And some indexes exist to enforce a constraint rather than to accelerate a query — nothing scans them and something needs them.

"Nothing scans it" and "nothing needs it" are different statements, and only the first is visible. Until a topology model can close that gap the verdict is not verifiable, so by the fourth invariant the capability cannot reach L5 — and dropping an index is expensive to reverse, so it does not belong at L4 either. Detection runs; the decision stays with a person. That is not a missing feature. It is the model working.

Why this is the architecture rather than a safety feature

Safety bolted onto a system that could otherwise act freely is a promise. Safety expressed as the set of actions that are structurally eligible for autonomy is a design. The difference shows up on the day something goes wrong, which is the only day it matters.