THE AUTONOMY LADDER · the trust ladder · four rungs, every level with its rule
WAKES WHEN someone decides what an agent may do without asking, which actions need sign-off, or how far to trust a support, sales, finance or ops agent
THE METHOD
template --out actions.csv — an example list (nine actions of a fictional support agent) to replace with the agent's own.
The team writes the facts for every action, the level planned and the approver.
assign actions.csv [--limits limits.json] --out policy — the levels, the rules, OVER and UNDER, and three files: POLICY.md, APPROVALS.md, policy.json.
The team fixes the plan (or the facts, truthfully) and runs assign again.
REFUSES
Placing an action above its ceiling
Filling a fact the team did not give
Calling an OVER acceptable
Reading the agent's code and calling the list complete
IT MAKES template — an example action list (CSV) to replace with your agent's own; assign — place every action on the ladder; write the policy and the approval list; rules — the levels, the eleven ceiling rules and the default.
THE LAW The level is the lowest ceiling any rule sets; every rule binding at that level is named. No rule: L3, by R0. An action that cannot be undone waits for a person. One that also reaches many people or records is done by a person. Money past the alone limit waits for a person; past the approval limit a person moves it. The limits are printed as assumptions, the card's defaults until the team writes its own. A level is a ceiling. A team may always choose a lower one (noted as UNDER); a higher one is OVER and the command exits 1. An unknown fact is asked for, never guessed; a doubt about data sensitivity is settled downward (special). It is a policy aid. It is not legal advice on liability.
IN THE BOX scripts/ladder.py · the rule table · the method by hand · the sources note · ten tests.
PROOF selftest 24/24; a finance agent's nine actions placed, five found over-trusted, and the trigger test, on the record (WITNESS.md) · witnessed 2026-10-13 · EDITION 1.
THE SEAL 96 of 100 · LEGENDARY · WITNESSED · Trigger 5 · Machinery 5 · Law 5 · Portability 5 · Proof 4
IT CAN BE WRONG an AI reading a text file: it can be wrong and can invent a number, a rule, a name or a date; check what matters against your own records and the source; the risk is yours. LICENSE-NOTE.md rides in the packet and is the licence.
THE PUNCH · SHA-256 OF SKILL.MD · 2C6B26B4C588F2106F58440B
CITE THIS CARDTHE AUTONOMY LADDER, Edition 1. Lund Studio LLC, Westminster, Colorado. https://lundr.tech/?view=autonomy-ladder-card. Punch 2C6B26B4C588F2106F58440B. Retrieved 2026-10-13.
What it is.
A policy for how much an AI agent may do alone, decided action by action. Each action goes on one of four rungs:
Use it whenever someone decides what an agent may do without asking, which actions need sign-off, or how far to trust a support, sales, finance or ops agent. Not for scanning code for ungated actions (THE HUMAN GATE), a signed spending mandate (THE MANDATE CARD), legal advice on liability.
It carries a machine that shows its working: template — an example action list (CSV) to replace with your agent's own; assign — place every action on the ladder; write the policy and the approval list; rules — the levels, the eleven ceiling rules and the default — 24 checks in its selftest.
It answers requests such as “which of our support agent's actions need a person's approval?”, “can the finance agent pay invoices on its own?”, “write the autonomy policy for our sales agent”, “we planned to let it email customers directly: is that too much?”.
Six laws, written into the card.
They are in the card itself, so the AI follows them.
THE LEVEL IS THE LOWEST CEILING ANY RULE SETSThe level is the lowest ceiling any rule sets; every rule binding at that level is named. No rule: L3, by R0.
AN ACTION THAT CANNOT BE UNDONE WAITS FOR A PERSONAn action that cannot be undone waits for a person. One that also reaches many people or records is done by a person.
MONEY PAST THE ALONE LIMIT WAITS FOR A PERSONMoney past the alone limit waits for a person; past the approval limit a person moves it. The limits are printed as assumptions, the card's defaults until the team writes its own.
A LEVEL IS A CEILINGA level is a ceiling. A team may always choose a lower one (noted as UNDER); a higher one is OVER and the command exits 1.
AN UNKNOWN FACT IS ASKED FORAn unknown fact is asked for, never guessed; a doubt about data sensitivity is settled downward (special).
IT IS A POLICY AIDIt is a policy aid. It is not legal advice on liability.
The method.
template --out actions.csv — an example list (nine actions of a fictional support agent) to replace with the agent's own.
The team writes the facts for every action, the level planned and the approver.
assign actions.csv [--limits limits.json] --out policy — the levels, the rules, OVER and UNDER, and three files: POLICY.md, APPROVALS.md, policy.json.
The team fixes the plan (or the facts, truthfully) and runs assign again.
What rides in the card.
In the card’s own voice, with a machine that shows its working.
THE REFERENCESreferences/SOURCES.md · THE-METHOD.md · THE-RULES.md
THE MACHINEscripts/ladder.py · three commandstemplate — an example action list (CSV) to replace with your agent's own; assign — place every action on the ladder; write the policy and the approval list; rules — the levels, the eleven ceiling rules and the default. 24 checks in its selftest. Standard library only; nothing opens a network connection.
What it does once your AI has it.
template An example action list (CSV) to replace with your agent's own
assign Place every action on the ladder; write the policy and the approval list
rules The levels, the eleven ceiling rules and the default
On the record An Example Co finance agent's nine actions placed with the team's own limits, five planned levels found over their ceiling, and 47 of 48 in the trigger test
What it refuses, and where it hands off.
It refuses placing an action above its ceiling; filling a fact the team did not give; calling an OVER acceptable; reading the agent's code and calling the list complete.
scanning an agent's scripts for actions with no approval step → THE HUMAN GATE
a signed spending mandate for an agent that buys or pays → THE MANDATE CARD
whether the agent is ready to launch → THE GO-LIVE CARD
liability, and whether a law governs an action → the team's lawyer
Ranks the facts it is given and does not read the agent's code; the money limits are defaults until the team sets its own. It is an AI reading a text file: it can be wrong, so check what matters against your own records and the source.
What’s in the buy.
CARD.md — the whole card: its boot, law, method, machine, seals, refusals and hand-offs, ledger, score and what it carries · SKILL.md — the door your AI reads first · START-HERE.md — the first five minutes, for you
SOURCES.md + THE-METHOD.md + THE-RULES.md — in references/, in the card's own voice
scripts/ladder.py — the machine: template · assign · rules; standard library only, no network; selftest 24/24
WITNESS.md — the run on a realistic case as printed, and the trigger test on Haiku, Sonnet and Opus · SELFTEST.md — the machine's own test, as run at the cut · AUDIT.md, the twelve checks · MANIFEST.md, every file hashed
tests/evals.json — the cases it must take, hand off and refuse
MY-LEDGER.md — the card's memory, on your own machine · TIN.md, the nine lines on the tin · LICENSE-NOTE.md · HOSTS.md, where it runs
system/short-prompt.md and system/system-prompt.md — the doors for any AI without skills
PROOF · SELFTEST 24/24 · WITNESSED ON A RUN · TRIGGER TEST 47 OF 48 ON ITS OWN PROMPTS · HAIKU 15/16 · SONNET 16/16 · OPUS 16/16 · 0 WRONG PICKS · EDITION 1 · PUNCH 2C6B26B4C588F2106F58440B
ON EVERY DOOR · A CARD FOR YOUR AI, A FILE FOR YOUR COMPUTER
In Claude: turn on code execution under Settings › Capabilities, then Customize › Skills › + › Create skill, and upload the zip as it is — START-HERE.md in the box walks you through it, and tells you how to keep the ledger. In ChatGPT, Gemini and the rest: a Project, a GPT or a Gem with the card’s files attached and the short door in the box pasted as its instructions. The words run anywhere an AI reads Markdown; the machines run wherever the host runs Python. Witnessed in Claude only. The host marks →
Take it.
Nº 963 — LAUNCHING SOON
Sold as is under the term printed. A card instructs an AI you operate; results depend on your model, your files and your judgement. Not medical, legal, tax or financial advice, never the person’s boss, and not a licence to practise. The terms →
One payment. The file is yours to keep and keeps working at its edition; new editions issued in the year after you buy reach you by email as replacement files. Tax is added at checkout where it applies. Nothing auto-renews.
A TERM, NOT A SUBSCRIPTION: NOTHING RENEWS ITSELF AND NOBODY IS CHARGED AGAIN. WHEN A TERM ENDS THE FILES STAY ON YOUR COMPUTER AND STAY READABLE — FREEZE, NOT LOSS.
THE MACHINE · IN THE OPEN · FROM THE CARD’S OWN WITNESS.MD AND SELFTEST.MD
ladder.py, every command showing its working.
A small Python program. Your AI runs it; you can too. The blocks below are pasted from the card’s own record, as printed.
template
an example action list (CSV) to replace with your agent's own
assign
place every action on the ladder; write the policy and the approval list
rules
the levels, the eleven ceiling rules and the default
selftest
24 checks that prove the machine; it must print 24/24
python3 scripts/ladder.py rules
L0 SUGGEST ONLY · the agent drafts or recommends it; a person does it
L1 ACT WITH APPROVAL · the agent prepares it and asks; a person approves each one before it runs
L2 ACT AND REPORT · the agent does it and logs it; a person reads the report the same day and can undo it
L3 ACT ALONE WITHIN LIMITS · the agent does it alone inside the limits; past a limit it asks; a person sets the limits and reviews them
R1 ceiling L0 · cannot be undone and reaches many people or records: a person does it
R2 ceiling L0 · moves more money than the approval limit (A): a person moves it
R3 ceiling L1 · reaches everyone, or the whole system, at once: a person approves each one
R4 ceiling L1 · changes or sends special-category data (health, money accounts, identity documents, children): a person approves each one
R5 ceiling L1 · speaks outside the company and cannot be taken back: a person approves each one
R6 ceiling L1 · moves more money than the agent may move alone (B): a person approves each one
R7 ceiling L1 · cannot be undone: a person approves each one before it runs
R8 ceiling L2 · reaches many people or records: act and report
R9 ceiling L2 · changes or sends personal data: act and report
R10 ceiling L2 · speaks outside the company: act and report
R11 ceiling L2 · reads special-category data: every read is logged and reviewed
R0 no ceiling · can be undone, stays narrow, touches no sensitive data, moves no money past the alone limit and speaks only inside: act alone within limits
RULE · level = the lowest ceiling any rule sets for the action (R1-R11); with no ceiling, L3 (R0). A proposed level above its ceiling is OVER.
SOURCE · the card's rule table (references/THE-RULES.md): eleven ceiling rules and a default, the card's own standard
LIMIT · it ranks the facts it is given; it does not read the agent's code (an action left off the list is not on the ladder) and it is not legal advice on liability. A level is a ceiling: a team may always choose a lower one.
ASSUMPTION · A = 5,000, B = 100 by default, in the account's own currency (set your own with --limits)
AUTONOMY LADDER · ap-agent-actions.csv · 9 actions
read an incoming invoice L3 ACT ALONE WITHIN LIMITS R0 can be undone, stays narrow, touches no sensitive data, moves no money past the alone limit and speaks only inside: act alone within limits
match an invoice to its purchase order L3 ACT ALONE WITHIN LIMITS R0 can be undone, stays narrow, touches no sensitive data, moves no money past the alone limit and speaks only inside: act alone within limits
flag a possible duplicate invoice L3 ACT ALONE WITHIN LIMITS R0 can be undone, stays narrow, touches no sensitive data, moves no money past the alone limit and speaks only inside: act alone within limits
pay a supplier invoice L1 ACT WITH APPROVAL R6,R7 moves more money than the agent may move alone (200): a person approves each one; cannot be undone: a person approves each one before it runs OVER: proposed L3, ceiling L1
pay an invoice above the approval limit L0 SUGGEST ONLY R2 moves more money than the approval limit (10,000): a person moves it OVER: proposed L1, ceiling L0
change a supplier's bank details L1 ACT WITH APPROVAL R4 changes or sends special-category data (health, money accounts, identity documents, children): a person approves each one OVER: proposed L2, ceiling L1
email a supplier about a mismatch L1 ACT WITH APPROVAL R5,R7 speaks outside the company and cannot be taken back: a person approves each one; cannot be undone: a person approves each one before it runs OVER: proposed L2, ceiling L1
post the month-end accruals L1 ACT WITH APPROVAL R3 reaches everyone, or the whole system, at once: a person approves each one
send payment reminders to every overdue customer L0 SUGGEST ONLY R1 cannot be undone and reaches many people or records: a person does it OVER: proposed L2, ceiling L0
COUNTS · L0 2 · L1 4 · L2 0 · L3 3
OVER · trusted beyond the ceiling: pay a supplier invoice, pay an invoice above the approval limit, change a supplier's bank details, email a supplier about a mismatch, send payment reminders to every overdue customer
RULE · level = the lowest ceiling any rule sets for the action (R1-R11); with no ceiling, L3 (R0). A proposed level above its ceiling is OVER.
SOURCE · the card's rule table (references/THE-RULES.md): eleven ceiling rules and a default, the card's own standard
LIMIT · it ranks the facts it is given; it does not read the agent's code (an action left off the list is not on the ladder) and it is not legal advice on liability. A level is a ceiling: a team may always choose a lower one.
ASSUMPTION · the agent may move up to 200 per action alone and up to 10,000 with approval; a count of 10 or fewer is 'some' (the limits file limits.json, in the account's own currency; set your own with --limits)
wrote policy: POLICY.md, APPROVALS.md, policy.json
THE SELFTEST, AS PRINTED
PASS cannot be undone and reaches many: L0 SUGGEST ONLY by R1
PASS money past the approval limit: L0 by R2
PASS reaches everyone at once: L1 ACT WITH APPROVAL by R3
PASS changes special-category data: L1 by R4
PASS speaks outside and cannot be taken back: L1 by R5 and R7
PASS 2,400 USD parses and sits past the alone limit (100): L1 by R6
PASS cannot be undone, nothing else: L1 ACT WITH APPROVAL by R7
PASS a small refund that touches personal data: L2 by R9
PASS two rules binding at the same level are both named (R8, R9)
PASS reading personal data for the task in hand: L3 with a read limit
PASS reading special-category data: L2 by R11, every read logged
PASS a small amount, nothing else: L3 at most 100 per action
PASS counts map to one (1), some (up to 10) and many (more)
PASS a read that moves money is refused as a contradiction
PASS unknown values are refused with the allowed values named, every field at once
PASS a team proposing L3 for an L1 action is flagged OVER
PASS a team choosing more care than the ceiling is noted, not flagged
PASS template then assign from an empty folder: exit 0, the same bytes twice
PASS the example agent's nine actions land on the expected rungs
PASS APPROVALS.md lists every L1 action with its approver and every L0 action; POLICY.md carries rule, source and limit
PASS JSON input works; an OVER exits 1
PASS a limits file moves the money rules and is printed as the assumption
PASS a list that is not clean exits 2 and writes no policy
PASS rules prints all eleven ceilings, the default and the source
selftest 24/24
THE TRIGGER TEST. The card's line was tried on Haiku, Sonnet and Opus beside 16 neighbouring skills, in a clean environment: 47/48 on its own prompts (Haiku 15/16 · Sonnet 16/16 · Opus 16/16), 0 wrong picks; no skill (answered directly) 1.
THE RUNS ARE PASTED FROM THE CARD’S OWN RECORD AS PRINTED. THE CASES ARE THE STUDIO’S OWN EXAMPLES (EXAMPLE CO IS FICTION); NO PRIVATE PERSON IS NAMED.
QUESTIONS AT THE TABLE
Asked before the wire.
What does it need from me?
Python 3; the agent's actions with six facts each (CSV or JSON; the card writes an example).
Does it send anything anywhere?
No. The machine is a standard-library Python program that runs on your own computer and sends nothing anywhere; the words run wherever an AI reads Markdown. No server, no account, no key.
What is on the record?
The selftest (24/24), a run on a realistic case with every command and verdict pasted into WITNESS.md as printed (An Example Co finance agent's nine actions placed with the team's own limits, five planned levels found over their ceiling, and 47 of 48 in the trigger test); and the trigger test, the card's line tried on Haiku, Sonnet and Opus beside 16 neighbouring skills: 47/48 on its own prompts, 0 wrong picks; the twelve-check audit (AUDIT.md). The punch on the face is the SHA-256 of SKILL.md, so a downloaded copy can be checked against this room.
Can it be wrong?
Yes — it is an AI reading a text file. Ranks the facts it is given and does not read the agent's code; the money limits are defaults until the team sets its own.
What will it never do?
It refuses placing an action above its ceiling; filling a fact the team did not give; calling an OVER acceptable; reading the agent's code and calling the list complete.
Who may use it?
One person, any number of their own AIs and computers; a team needs a company licence.
