Pattern
Graduated Autonomy
Autonomy is granted per workflow across four levels, from observe to operate within policy, against measured shadow-mode agreement, with drift monitoring and a rollback path. A single global autonomy score is unsafe.
Thesis
Claim: recommendation
Autonomy is a property of a workflow, not of a system, and it should be granted the way a privilege is granted: narrowly, against evidence, and revocably.
The argument
Claim: inference
Four levels are enough to be useful and few enough to be governed. Level 0 observes and says nothing. Level 1 prepares: drafts messages, notes, care-plan updates and evidence for human approval. Level 2 executes approved low-risk work: reminders, follow-ups, classification, evidence assembly. Level 3 operates within policy for a defined cohort.
The unit that receives a level is one workflow, because agreement with human judgment is not uniform across workflows. In the reference implementation, monitoring exceptions run at low drift with hundreds of runs a week, while the post-discharge transition workflow shows materially higher drift on far fewer runs. Those two facts justify opposite autonomy decisions, and a single global score would have averaged them into a wrong one.
Promotion is earned in shadow mode: the system observes, recommends and records while nothing reaches a patient, an EHR or a billing system, and its recommendations are compared against what people actually did. Demotion has to be as easy as promotion, and a workflow whose drift rises should fall back without a project.
Each workflow also carries a written operating constraint in plain language, which is the thing a compliance lead reads. Any patient response containing risk language bypasses automation entirely.
What a legacy vendor would say
Claim: inference
That per-workflow autonomy is unmanageable at scale, that customers want one switch, and that any autonomy at all in care management invites a regulatory finding no efficiency gain can pay for.
The management burden is real. Eight workflows are governable; eighty are a second full-time job, and this pattern has not been tested at that width.
What would settle it
Claim: recommendation
Agreement measured per workflow over enough comparisons to be meaningful, with the residual disagreement characterized rather than summarized. The gate should be structural, not numeric: promotion requires that the disagreement that remains is explainable and that its consequences are bounded.
In the prototype's synthetic shadow-mode data, overall agreement sits at 94 percent over 1,382 comparisons, and the remaining 6 percent clusters almost entirely in patients with a recent medication change. That is the shape of the argument: the residual is not noise, it is a named context in which autonomy should stay low.
Open questions
Claim: unknown
How long a promotion should hold before it must be re-earned. Whether autonomy should be scoped to cohorts within a workflow as well as to the workflow itself. What the correct automatic response to a drift spike is, and whether it should require a human at all.