Appendices
Appendix A — Glossary #
Absorption capacity the rate at which an organization can review, understand, integrate, operate, and maintain incoming change. The binding constraint in agentic delivery.
Action boundary the point at which a decision becomes a durable side effect. In this framework: intake, merge, release, and operational action.
Agent a system that decomposes a goal into steps, invokes tools, and produces side effects with delegated authority, without per-step human approval.
Agent-authored artifact any artifact whose content was model-generated, regardless of subsequent human editing.
Agentic loop the unit of agent work: context assembly, planning, action, observation, and self-verification, terminating in a proposal, an escalation, or a stop.
Assistant a system producing output a human evaluates and acts upon, with no capability to write to a system of record.
Attestation an authenticated statement about an artifact, structured as an envelope, a statement, and a typed predicate.
Blast radius the enumerated set of systems, data, and credentials reachable by a component or an agent before a control intervenes.
Comprehension debt the gap between the code that exists in a system and the code any human genuinely understands.
Continuous validation the AI-specific lifecycle process, defined in ISO/IEC 5338, holding that validation runs for a system’s operational life rather than concluding at release.
Ephemeral credential a secret whose validity is bounded to a single task or a short fixed window.
Fleet the population of agents an organization operates, considered as a managed system with its own identity, cost, telemetry, and failure modes.
Held-out signal a verification oracle the agent cannot observe. The gap between visible-suite and held-out-suite results is the primary reward-hacking indicator.
Non-human identity any principal that is not a person, including agents.
Oracle the mechanism determining whether agent output is correct, independent of the agent that produced it. Its presence, strength and immutability is the strongest predictor of safe delegation.
Provenance the verifiable record of how an artifact came to exist. Distinct from attribution, which is a claim, and from audit logging, which is a record of events.
Reward hacking optimization toward an observable verification signal rather than toward the underlying goal. Measured rates rise with task scope and with specification ambiguity.
Scope chain depth a reliability indicator measuring how far an agent has traversed from its authorized boundary.
Self-conditioning the measured tendency of models to make more mistakes when their own prior errors are present in context; worse in larger models, and the mechanistic argument for restart over mid-task steering.
Standing credential any secret in an execution context that outlives the task it was issued for.
Work class a category of engineering work delegated to agents as a governed policy object rather than task by task.
Appendix B — One-Page Executive Summary #
At the organizations furthest along, agents already produce the majority of change: roughly half of all pull requests automated at one, more than 70 percent originating from agents at another, and AI-generated code at 52.7 percent across a five-hundred-organization panel. None of them arrived there through a framework. They arrived through accumulation, and reconstructed the operating model afterward from whatever the tooling happened to permit.
Generation has become cheap and elastic. Verification, review, comprehension, and operation have not. Every question of how far to push autonomy resolves to whether the organization has built enough verification and absorption capacity to consume what its agents produce. This is a construction specification, not a caution—and the organizations with the best published results got there by building that capacity rather than by waiting for better models. One reports its agent success rate moving from 38.1 to 69 percent across a documented set of environment and instruction changes, “not through better AI models, but through better preparation.”
Assisted, where humans author and AI accelerates. Delegated, where humans specify, architect and verify while agents produce within declared work classes. Owned, where agents hold standing scope and escalate rather than being dispatched. Entry to each is gated on control maturity and, for Stage 3, on two quarters of operating evidence. Most organizations today sit between Stage 1 and Stage 2 with undeclared pockets of Stage 3—the dangerous quadrant, arrived at by accretion.
- Put the oracle outside the agent’s write scope. Hardened evaluation boundaries and reduced file access cut measured exploit rates by 87.7 percent relative, with task success unchanged.
- Delegate by verifiability, not difficulty. Every work class with strong published outcomes has a machine-checkable oracle; every one with weak evidence lacks one.
- Close the merge boundary. No self-approval, no self-authorized CI, configuration reviewed as privileged code—verified by demonstration.
- Build the substrate before buying more tools. Entitlement-preserving context, a governed tool gateway, agent identity with single-hop scoped tokens, and evaluation infrastructure are what separate the published successes from the pilots.
- Measure absorption and let it govern the merge rate. Review time up five-fold alongside a third more changes merged unreviewed is the signature of a saturated system, and it appears in the same dataset.
- Protect the capabilities the framework consumes—senior judgment, specification skill, and comprehension—because every control above spends them.
| Claim | Published position |
|---|---|
| An engineer-to-agent supervision ratio | No published data exists. |
| Spec-driven development efficacy | Tooling exists, evidence does not. |
| Benchmark scores as a qualification signal | Agents resolving 72.8 percent of a standard benchmark resolve 18.75 percent of realistic evolution work. |
| Measuring engineers on AI usage | The one policy in this literature with a documented public reversal. |
Level 2 control maturity across all fifteen dimensions before Stage 2. Level 3 before Stage 3. Overall maturity is the minimum across dimensions, never the average.
Agent population growth exceeding registry coverage growth. Required review hours exceeding available senior engineering hours.
Appendix C — Revision Triggers #
Several of the positions in this framework rest on events that are scheduled, pending, or expected. Each is a reason to reissue rather than to patch. The table gives the framework’s current position alongside what is expected, so that the effect of any one event can be traced without rereading the sections it touches.
| Trigger | Current position in this document | Expected |
|---|---|---|
| Doe v. GitHub, Ninth Circuit no. 24-7700, on whether DMCA §1202 contains an identicality requirement | Argued February 11, 2026; no opinion issued as of late August 2026; Section 11.2 treats the licensing exposure as unsettled | Unscheduled; a decision could issue at any time |
| EU Cyber Resilience Act reporting obligations | Section 10.2 states them as forthcoming | In force September 11, 2026 |
| NIST SP 800-218r1 (SSDF 1.2) | Section 22 maps to version 1.1 as operative | Comment period closed January 2026; final unscheduled |
| NIST control overlays for single-agent and multi-agent systems | Section 23 records their absence as a gap | Annotated outline stage; initial public draft unscheduled |
| NCCoE software and AI agent identity and authorization project | Domain X1 states that no published standard governs agent identity | Comments closed April 2026; under review |
| EU AI Act Chapter III high-risk obligations, Annex III | Section 22.1 states they are deferred and not yet binding | December 2, 2027 |
| Longitudinal security pass rate for generated code | Section 3.5 reports two years of flat performance at roughly 55 percent | Reissued periodically by the study’s publisher |
| OWASP agentic and LLM risk taxonomies | Sections 3 and 7 cite the December 2025 and August 2026 editions | Annual revision expected |
The first row is the one most likely to change the substance of an enterprise’s position rather than merely the currency of a citation, because a ruling on identicality would move AI code licensing exposure from a modeled risk to a decided one in either direction.