Match authority to consequence
A model's capability does not grant it permission. The product assigns authority based on potential harm.
Interactive product study · Enterprise AI
Decide where AI stops.
Change the operating conditions. The control policy updates before the agent gets authority.
Capability is not permission.Authority follows consequence, reversibility, evidence, and intent.
02
Fresh approvalRecommended control policy
Policy recommendation
Preview + fresh approval
Pause before the consequential action and bind approval to the exact committed state.
ConsequentialThe cost of error is material.
Hard to reverseRecovery cannot be assumed.
Intent can expireApproval must match current state.
Current statePolicy ready
RUN-0042Prepared form is inspectableNo external action has occurred.
Approve this committed state?Any input change invalidates this approval.
Reusable product patterns
Four controls, not one approval modal.
The right pattern changes with the action. Each card loads a scenario that makes the boundary concrete.
Product judgment
The operating model is part of the interface.
Bind approval to state
Approval expires when inputs, evidence, navigation, or the proposed action changes.
Design recovery with execution
Undo, reject, escalate, and fail-closed states belong in the primary workflow.