Graduated Autonomy

Autonomy is a property of a workflow, not of a system, and it should be granted the way a privilege is granted: narrowly, against evidence, and revocably.

Four levels are enough to be useful and few enough to be governed. Level 0 observes and says nothing. Level 1 prepares: drafts messages, notes, care-plan updates and evidence for human approval. Level 2 executes approved low-risk work: reminders, follow-ups, classification, evidence assembly. Level 3 operates within policy for a defined cohort.

The unit that receives a level is one workflow, because agreement with human judgment is not uniform across workflows. In the reference implementation, monitoring exceptions run at low drift with hundreds of runs a week, while the post-discharge transition workflow shows materially higher drift on far fewer runs. Those two facts justify opposite autonomy decisions, and a single global score would have averaged them into a wrong one.

Promotion is earned in shadow mode: the system observes, recommends and records while nothing reaches a patient, an EHR or a billing system, and its recommendations are compared against what people actually did. Demotion has to be as easy as promotion, and a workflow whose drift rises should fall back without a project.

Each workflow also carries a written operating constraint in plain language, which is the thing a compliance lead reads. Any patient response containing risk language bypasses automation entirely.

That per-workflow autonomy is unmanageable at scale, that customers want one switch, and that any autonomy at all in care management invites a regulatory finding no efficiency gain can pay for.

The management burden is real. Eight workflows are governable; eighty are a second full-time job, and this pattern has not been tested at that width.

Agreement measured per workflow over enough comparisons to be meaningful, with the residual disagreement characterized rather than summarized. The gate should be structural, not numeric: promotion requires that the disagreement that remains is explainable and that its consequences are bounded.

In the prototype's synthetic shadow-mode data, overall agreement sits at 94 percent over 1,382 comparisons, and the remaining 6 percent clusters almost entirely in patients with a recent medication change. That is the shape of the argument: the residual is not noise, it is a named context in which autonomy should stay low.

How long a promotion should hold before it must be re-earned. Whether autonomy should be scoped to cohorts within a workflow as well as to the workflow itself. What the correct automatic response to a drift spike is, and whether it should require a human at all.