Process Autonomy Classification
Eight questions that decide which autonomy band a single enterprise process may safely occupy, where the band is the lowest ceiling any one answer imposes rather than an average.
Version 0.1, draft, published 2026-08-11. Eight questions that decide which autonomy band one process may safely occupy.
A process sits in the LOWEST band any single answer permits. Not the average, not the majority. A process that is high-frequency, well-understood, cheap to run and IRREVERSIBLE is a Human Required process, and the four favourable answers do not move it. Averaging here is how an irreversible action ends up automatic because most of its other properties looked good.
Why the usual question is the wrong one
Every autonomy programme starts with the same conversation, and it is the wrong one: which processes COULD we automate. That question is answered by capability, and capability has never been the constraint. The question that decides an outcome is which processes may be automated SAFELY, and it is answered by reversibility, blast radius and whether a failure would be noticed.
The difference matters because the processes easiest to automate are frequently the ones where being wrong is cheapest to ignore and most expensive to discover.
The four bands
| Band | Ladder | What it means | |
|---|---|---|---|
| Band 0 | Human Required | Level 0 to 1 | A machine may observe and may propose. A human decides and a human acts. |
| Band 1 | Human Assisted | Level 2 | A machine prepares and executes; a human approves each action before it runs. |
| Band 2 | Policy Autonomous | Level 3 | A machine acts without asking, inside a written policy envelope agreed in advance. |
| Band 3 | Fully Autonomous | Level 4 | Detect, act and verify without a human in the loop for that cycle. |
They map onto the Autonomy Ladder, which defines what each level requires before a system may operate there.
The eight questions
Each answer sets a CEILING. The band is the lowest ceiling any answer imposes.
Is this process on the never-autonomous list: identity or entitlements, deletion without a tested restore, financial commitment, records an auditor treats as a control, production containment, safety, or communicating externally?
- Band 0 ceiling — Yes
The cost of being wrong is not recoverable by a rollback, which is the control every band above 0 depends on. - Band 3 ceiling — No
Is the action reversible, and has the rollback actually been executed under production conditions?
- Band 0 ceiling — Not reversible
Nothing above Band 0 is safe when the action cannot be undone. - Band 1 ceiling — Reversible in theory, never tested
An untested rollback is a hope. It may be approved action by action; it may not run unattended. - Band 3 ceiling — Reversible and tested in production conditions
Is the blast radius bounded and named, or could one action affect an unbounded set of systems?
- Band 0 ceiling — Unbounded or unknown
An action whose reach nobody can state is an action nobody can approve. - Band 1 ceiling — Bounded but not enforced technically
A bound that exists only in a document is a bound somebody can exceed by accident. It may be approved action by action; it may not run unattended. - Band 3 ceiling — Bounded and enforced by the system itself
Can success be verified automatically, and does that verification test the SYMPTOM rather than the action completing?
- Band 1 ceiling — No automatic verification
Without verification a machine cannot know it succeeded, so a human must. - Band 2 ceiling — Verifies the action completed
Restarting a service and confirming the service restarted proves nothing about the incident. - Band 3 ceiling — Verifies the symptom is gone
If this went wrong, how long before somebody noticed?
- Band 0 ceiling — Possibly never, or only when a customer complains
An undetectable failure is the one automation makes worse, because it removes the person who would have noticed. - Band 2 ceiling — Within a day
A day is survivable for a reversible action and too long for a closed loop, which can repeat the same mistake several hundred times before anyone looks. - Band 3 ceiling — Within minutes, by an alarm that has been seen to fire
Is there a written policy envelope naming permitted actions, targets, time windows and rate limits?
- Band 1 ceiling — No
Band 2 is defined by the envelope. Without one there is nothing for the machine to act inside. - Band 1 ceiling — Written but broad enough that reasonable people would disagree
An envelope that cannot be applied consistently is not an envelope. - Band 3 ceiling — Written, specific, and two engineers would agree on any given action
Can the loop stop itself after a stated number of consecutive failures?
- Band 2 ceiling — No
A loop that cannot stop itself is unattended, not closed. It may act within a policy; it may not run a closed loop. - Band 3 ceiling — Yes, and the threshold is written down
How often does this process run?
- Band 1 ceiling — Rarely, a few times a year
Not a safety cap but an economic one: automating rare work costs more than it saves and the automation rots between runs. - Band 3 ceiling — Weekly or monthly
- Band 3 ceiling — Daily or continuously
A worked example, and the single answer that decides it
Illustrative. A WORKED EXAMPLE. Composed to show how the rule bites, and describing no real organisation's process.
Restarting a stateless web worker when its health check fails answers favourably on all eight and reaches Band 3, Fully Autonomous.
Change one answer - the rollback has never actually been exercised - and the same process drops to Band 1, Human Assisted. Seven favourable answers do not compensate for the one that decides it.
What we operate
BvLogic operates every one of its own processes at Band 0 or Band 1. Nothing here is running at Policy Autonomous or above, including our own deploys, which are deliberately Human Assisted because the deploy gate's value is that a person reads the result before the swap.
How this gets gamed
- Classifying by how easy the process is to automate rather than how safe it is to get wrong. Capability was never the constraint.
- Answering 'reversible' on the strength of a backup nobody has restored. An untested rollback is a hope, and this is the single most common wrong answer.
- Writing an envelope broad enough to cover everything, which converts Band 3 into Band 0 with paperwork.
- Verification that confirms the action rather than the outcome. It passes every time and proves nothing.
- Averaging the answers. The rule is the lowest cap, and averaging is how an irreversible action becomes automatic because its other properties looked good.
Run it
python tools/process_classify.py --questions
python tools/process_classify.py --demo
python tools/process_classify.py --answers your-process.jsonLicence. This specification is published under CC BY 4.0: implement it commercially, republish it, adapt it, with attribution and a note of what you changed. The conformance harness is MIT. Full terms and what is not covered: the licence page.
Everything here is free and stays free. There is no form in front of any document. If you want to know when new guides and templates go up, leave an email.
Roughly monthly. Unsubscribe in one click. We do not share your address, and we will not call you.