Earn the Next Level

ℹLeadership brief

What it is: the record that raises or lowers an action class’s autonomy level — signed, dated, evidenced by named receipt ids rather than a config flag flipped on a hunch.

What it buys: a level that only ever moves on paper somebody signs, and a demotion that fires the moment a verification fails rather than after a pattern someone has to notice first.

What to fund: the review that reads receipts before every promotion, and the standing rule that the first failed verification demotes automatically, before anyone argues about whether this time was different.

Before the detail — Artifact: the autonomy-change record. Status of what follows: reusable guidance, built on the joint agentic guidance’s own vocabulary for raising and rolling back autonomy.

Prompt first: draft the next row, in the record’s own schema

Here is policy/autonomy-changes.jsonl's row shape and its two committed
rows [paste], and our receipt log filtered to one action class [paste
receipts_query.py --action pre_position_crew --stats and the individual
rows it lists].

Draft a NEW row in this exact schema - no other fields, no renamed ones:
  change_id, action, from_level, to_level,
  trigger (one of: verification-failed | compensation-failed |
    clean-evidence-window | owner-decision - no other value),
  receipt_ids (the ids themselves, not a count),
  approved_by (must equal the register's own subject.owner),
  effective_at, signature

Do not invent a trigger outside the four the schema allows, and do not
sign the row - that is guard/validate_autonomy_changes.py --sign's job,
not an agent's. If no receipt in our window supports the requested
to_level, write NOT ENOUGH RECEIPTS YET instead of drafting the row.

An agent can format a row in the schema’s shape from any ids it is handed; only guard/validate_autonomy_changes.py can confirm a cited receipt resolves in a chain that itself verifies, and only the named owner can sign it. Drafting is not validating, and validating is not signing.

Autonomy is a record, not a flag

policy/autonomy-changes.jsonl is that record, committed: one JSON row per promotion or demotion, citing change_id, action, from_level, to_level, trigger, receipt_ids, approved_by, effective_at, and a signature — HMAC-SHA256 (a keyed fingerprint: change any signed field and it stops matching) over every other field, keyed with a NON-PRODUCTION signing key. The guard still reads its starting mapping from policy/envelope.json alone; this file governs changes to that mapping — a record change, not a config change — and guard/validate_autonomy_changes.py replays every row against the chains it cites:

autonomy record ok: 2 signed change(s) in policy/autonomy-changes.jsonl
  AC-2026-0914-01  DEMOTION  pre_position_crew  L1-approval-required -> L0-never-autonomous
      trigger verification-failed  effective 2026-09-14T20:05:00Z
  AC-2026-0922-01  promotion pre_position_crew  L0-never-autonomous -> L1-approval-required
      trigger clean-evidence-window  effective 2026-09-22T15:00:00Z
  in force  pre_position_crew L1-approval-required - and policy/envelope.json runs it there too

AC-2026-0914-01 demotes pre_position_crew on receipt AR-70F1321A077D, the compensated-with-residual-impact row 3.3 already walked through. AC-2026-0922-01 promotes it back a week later, citing three verified receipts — every one dated after the demotion. Exit 0 means the record holds; exit 1 names which of its eight rules broke, in the script’s own header, including the two this training leans on hardest: a receipt reading compensated-with-residual-impact or compensation-failed REQUIRES a demotion row citing it, and a promotion may cite only receipts dated after the failure it reverses — a level is not earned back on evidence collected before it broke.

1.2’s four rungs are Meridian’s own labelled construct, pinned to the verb-to-level mapping the envelope file carries — this lesson does not re-derive them. What it adds is the signed, validated record that moves an action class from one rung to the next, and back down.

What earns it: receipts, not a request

Promotion is earned per action class, never per agent — send_dispatch_notice can sit at L0 while draft_work_order runs at L2, on the same agent, because each class carries its own evidence. The case for raising a class’s level is a run of receipts: a stated number of consecutive attempts at the current level, each with outcome verified or, for a class that requires approval, verified after a valid approval — and zero receipts in that window reading compensated, compensated-with-residual-impact, or compensation-failed. The evidence is the action_receipt_id values themselves, not a summary count, because a reviewer who can look up AR-A6A9D5DB577B and read the pre-state and post-state hashes for themselves is reviewing evidence; a reviewer handed only a success total is reviewing a claim.

One class in this training’s own register never enters this review at all: delete_backup is declared never-delegated — a standing deny the register assigns on purpose, not a level the agent has not yet earned. There is no rung to promote it to, because the decision was never “not yet”; it was “not this agent, not ever,” and a promotion review that quietly reopens a standing deny is itself the failure this training is built to catch.

Demotion on the first failed verification

Promotion takes a run of clean receipts; demotion takes exactly one. The moment a receipt’s own STEP 6 records a failed verification — whatever STEP 7 does next, whether the world came all the way back (compensated), came back except a declared residual (compensated-with-residual-impact), or did not come back at all (compensation-failed) — the action class demotes, before anyone convenes a review to discuss whether this time was different. 3.2’s clamp is the pattern this rule exists for: the tool reported success, verification caught what the tool did not, and the fact that a compensator then fixed it does not undo the fact that the plan and the outcome disagreed once already.

AI Assurance 6.1 (a separate training in this series) treats an incident as a review trigger and owns the broader register of them; this lesson adds no automatic demotion condition beyond the first failed verification. A kill-switch activation naming this agent (4.3’s subject) opens a review — it does not, on its own, demote a class the way a failed verification does.

Graduated autonomy, in the guidance’s own words

The joint agentic guidance — Careful adoption of agentic AI services (2026-04-30) — calls for graduated autonomy and says to roll back autonomy on failure. Those words are the guidance’s; Meridian’s four rungs and this lesson’s signed-record workflow are house constructs, built to satisfy a principle the guidance states in general terms without publishing a ladder of its own.

One more pointer closes the loop this lesson does not reopen: AI Assurance 4.2 — attack success reported across repeated attempts, not one try. The figures live in Lesson 1.1; this lesson carries only the pointer, because what carries forward here is the discipline, not the numbers.

Naming which words are the guidance’s and which are Meridian’s own construct is an audit finding avoided the day an assessor checks a leadership brief against the guidance itself and finds no ladder there to have mandated.

Stop and escalate when a promotion request has fewer receipts in its evidence window than the record’s own declared threshold, or when a declared failure trigger has already fired and someone proposes promoting anyway “because the fix worked.” Only the named owner — Distribution Operations, Mgr. L. Tran — signs a level change either direction; a reviewer who is not that owner can recommend, never sign.

KNOWLEDGE CHECK

An action class was demoted after a compensated-with-residual-impact receipt. Since the compensator was rewritten, every receipt in the record's declared evidence window is verified. A reviewer proposes restoring the prior level immediately. What does this lesson say?

Key takeaway

An action class’s autonomy level moves only on a signed, validated row in policy/autonomy-changes.jsonl: promotion earned by receipt ids dated after any failure they follow, demotion fired by the first one, whatever the compensator did next. delete_backup’s standing deny never enters this review at all — it was never a rung waiting to be earned. The joint agentic guidance’s own words, graduated autonomy and roll back autonomy, name the principle; the committed record and its validator are what make it a signed fact instead of a slogan. The capstone next runs MU-AI-011 through one full guarded night and produces the receipts this exact record already cites.

LEADERSHIP DECISION   no autonomy level moves without a signed
                      record citing named receipt ids - never a
                      config edit, and never a restoration by
                      argument after a demotion
PRACTITIONER ACTION   demote an action class on its first failed
                      verification automatically; draft every
                      promotion as a new record, evidenced fresh
SUCCESS MEASURE       audit finding avoided: every autonomy-level
                      change traceable to a signed record and named
                      receipt ids, zero traceable to a config commit