Autonomy is only safe if the stop conditions are real

Five ways a run comes to a halt

These are enforced by the platform rather than by the agent's judgement, which is the distinction that makes delegation defensible.

• Mandatory-review clauses — Named clauses stop every run, at every autonomy level. The gate is a property of the clause, so no configuration of the agent can carry it past a human.
• Outside the mandate — A position your playbook does not permit ends the turn. The agent does not improvise a compromise it was not authorised to offer.
• Threshold breaches — Contract value, discount depth, liability exposure or coverage shortfalls can each require a named approver before the run continues.
• Caps reached — Turn and spend ceilings pause the run with a summary rather than letting an unproductive negotiation continue indefinitely.
• Execution preconditions — Approvals and blocking conditions must be satisfied before signature is requested, so execution cannot outrun its own sign-offs.
• The kill switch — An organization-wide stop halts every agent immediately, and in-flight runs end at their current turn with the record intact.

A decision, not a transcript to read

Supervision fails when reviewing the agent costs more than doing the work. An escalation has to arrive as a question with enough context to answer in a minute.

• Routed by clause, not by document — Indemnity reaches legal, data terms reach privacy, pricing reaches finance. Nobody reads a 40-page agreement to find the three clauses that are theirs.
• Both positions, side by side — What the counterparty proposed, what your standard says, what the agent recommends and why — with the clause text, not a paraphrase.
• Answer once and it resumes — Your decision is applied to the clause and the run continues from where it stopped. There is no restart and no re-briefing.
• Queues that can be cleared — Review items accumulate as a queue of decisions, so a reviewer clears a batch rather than monitoring a conversation.

What the audit trail actually contains

None of this is generated on request. It accumulates as the agreement moves, which is why producing it is an export rather than an investigation.

• The document: Every version addressable and diffable
• The document: Amendments resolved against the clauses they change
• The document: Riders and exhibits versioned with the instrument
• The document: Timestamped, tamper-evident history
• The agent: Every turn in order, with its reasoning
• The agent: Each action attributed in the room timeline
• The agent: Tool calls recorded with their inputs and effects
• The agent: Mandate in force at the time of each turn
• The humans: Each approval bound to a version and an identity
• The humans: Overrides recorded as explicit acts, with who and when
• The humans: Signature identity captured per signatory
• The humans: Access and visibility scoped per party

The question you will be asked later

Eighteen months after signature, someone asks why a term says what it says. The difference between a good and a bad answer is whether the record was kept while it was cheap.

• Reconstructed from email: Which draft was signed is inferred from a file name
• Reconstructed from email: Approval is an email saying “looks fine” with nothing attached
• Reconstructed from email: Why a clause was conceded is lost with the person who conceded it
• Reconstructed from email: Agent or human is indistinguishable in the history
• Reconstructed from email: Producing evidence is a week of searching mailboxes
• Reconstructed from email: Any gap in the chain is argued against you
• Recorded as it happened: The signed version is identified and diffable against every earlier one
• Recorded as it happened: Each approval names a version, an approver and a timestamp
• Recorded as it happened: The turn that produced the clause carries its reasoning
• Recorded as it happened: Every agent action is attributed and distinguishable from a human's
• Recorded as it happened: Producing evidence is one export of a complete package
• Recorded as it happened: The chain is continuous because nothing had to be assembled

The questions that decide adoption

• Can a permissive autonomy level bypass a review gate? No. That is the architectural point: the gate belongs to the clause, not to the agent's settings. Raising autonomy changes what the agent may do with ungated clauses and has no effect on gated ones.
• Can we override the mandate for a specific deal? Yes, and the override is itself a recorded act with an identity and a timestamp. A decision to go outside policy is legitimate; a decision nobody can trace is not.
• How do we evaluate the agent before trusting it? Shadow mode produces the full run — proposals, recommended positions, prepared escalations — without anything reaching the counterparty. You compare the transcripts against what your team would have done, then raise autonomy per playbook.
• Is the history genuinely tamper-evident? Version history is timestamped and tamper-evident, so a later alteration is detectable rather than invisible. That is what makes the export usable as evidence instead of as a summary.