Conditional autonomy policy

Policy statement

Handlet will not execute any automated send action without a prior, logged eligibility evaluation event.

Default posture

• Conditional auto-send is off by default for every Pro workspace.
• The master switch and each per-intent toggle default to disabled until an operator enables them.
• The Automate ready replies preset is an explicit one-click configuration action. It is not an implicit always-on mode.

Gating conditions

Stage 1 (opt-in) covers master switch, per-intent toggles, confidence floor, and guardrails. Stage 2 (training unlock) adds a per-intent minimum validated training count before that intent's toggle can unlock.

All of the following conditions must be satisfied before automated send is permitted:

1. Confidence gate — evaluated confidence meets or exceeds the required threshold (platform floor 85%).
2. Threshold floor gate — required threshold is not below the configured threshold floor.
3. Degraded state gate — system degraded-state controls permit automation.
4. Restriction gate — account, policy, or workflow restrictions do not block automation.
5. Guardrail gate — guardrail checks pass for the candidate action.
6. Intent scope gate — the resolved intent’s per-intent toggle is enabled (when intent scopes are in use).
7. Stage 2 calibration gate — the per-intent validated training count meets the platform minimum before auto-send can unlock for that intent.

Stage 2 calibration gate (hard law)

Before auto-send can unlock for a given intent, the workspace must accumulate at least X validated calibration events for that intent:

A validated message is one calibration-eligible operator action:

Each qualifying event counts as one validated message. When the count is below the minimum for an intent, the toggle remains locked and send-time eligibility blocks stale or forged enabled settings. When the minimum is met, Ready for auto-send applies — but confidence ≥85%, guardrails, master switch, and per-intent toggles still apply.

See Calibration and confidence bar for how operators build training progress.

Per-intent guardrails

Even when an intent toggle is on, additional rules apply:

Platform-vetoed intents (risk, noise, unknown, unsupported, and related categories) are never auto-sent regardless of settings.

Enforcement mechanism

If a valid eligible evaluation is unavailable, automated send is blocked.

In the Action Queue, blocked auto-send attempts surface as:

Auto-send blocked — <BLOCKING_REASON_CODE>

(for example Auto-send blocked — CONFIDENCE_BELOW_THRESHOLD or Auto-send blocked — CALIBRATION_INSUFFICIENT_VALIDATED_MESSAGES). The machine-readable reasonCode field on the response carries the same code for programmatic consumers.

Audit trail requirements

Eligibility evaluation and execution events must share the same correlationId so investigators can reconstruct one contiguous decision-to-action chain.

Configuration changes emit audited events with actor, timestamp, intent scope changes, and when applicable apply_full_automation_preset.

Both evaluation and execution records are immutable once written and must remain available for compliance and audit review.

Review and override

A human operator may manually override a blocked auto-send only when:

• business urgency or service continuity requires immediate intervention
• the operator has sufficient contextual evidence to justify manual dispatch
• the operator accepts accountability for the override decision

When override occurs, the operator must ensure audit obligations are satisfied:

• record the manual action through approved human audit pathways
• retain machine-readable reason codes for blocking and override categorization
• preserve shared correlationId linkage across evaluation and override-related events

Related documentation

• Calibration and confidence bar
• Auto-send governance
• Pro auto-send overview
• Reviewing AI drafts