Every serious conversation about agent risk eventually arrives at the same place: not what the model can do, but what it is permitted to do, who decided that, and whether the decision is enforced anywhere other than a policy document.

We never update weights for a customer. Here is what we change instead, and why it is the better lever.

A certificate is not a score, a badge or a vendor claim. It is a depth, per capability, with an expiry date — earned against your own filed outcomes and read by the system at the moment the agent tries to act.

Everyone has evaluations now. Almost nobody has wired the score to anything that can stop an action.

“How autonomous should the agent be?” is the wrong question and it produces a policy nobody can enforce. The answerable version is narrower: which of these actions cannot be undone, and by whom.

Five bounds apply at once. The effective authority is the smallest, and naming which one is most of the job.

Two states are not enough. One step short and refused on purpose look identical in most systems, and they are not the same.

Three rails, three answers. The one where reversal is easy is the one where refusing it matters most.

The objection is that role scope looks over-restrictive. The reason it exists is not about trust.

Governance that only appears when something breaks is governance nobody believes is running.