The permission ladder: why AI employees should earn autonomy

When you hire a person, you do not hand them the company card on day one. You let them read, then draft, then handle small things alone, and at some point you notice you have stopped checking. Software agents mostly skip this. They launch with whatever access their API key carries, and the only dial is on and off. We think that is the single biggest reason teams do not trust agents with real tools, and it is the first thing we designed around.

A Pagerox employee works under a permission ladder instead. Every tool grant is set per operation, not per integration: reading an issue and creating an issue are different rows in the matrix, and each row sits at one of four levels.

Off means the operation does not exist for the employee. It is not refused by a prompt or hidden behind a policy sentence; it is never in the model's tool list at all. There is nothing to talk the employee into, because there is nothing to call.

Ask first is where every granted operation starts. The employee drafts the exact call it wants to make, and the draft parks as an approval request with the arguments frozen at that moment. A digest of those arguments is recorded; when a manager approves, the digest is verified again and the parked call executes exactly once. Not a re-run, not a fresh interpretation of what you probably meant: the thing you approved is the thing that happens. Reject it and nothing ran, and nothing retries.

Act and notify is the first step past approval. The employee runs the operation, then tells its manager what it did. This is the right level for operations you want visibility on without building a queue of rubber stamps: you find out every time, and you can move the operation back to ask first the moment something looks wrong.

On its own means the employee runs the operation directly, and every call lands in the audit log: what ran, when, and what came back. Pulling a CI config, answering a routine question, looking up an invoice. Quiet, but never invisible, and one toggle from back to ask first. Irreversible operations are a different story: deleting things, moving money, anything you cannot take back stays at ask first for a new hire, full stop.

Earned is the operative word, and it is a threshold, not a vibe. The approval history makes the case: three clean approvals of the same operation within 30 days, and the employee asks its manager to move that one up a level. The manager can say yes, say yes on a two-week trial that rolls back on one rejected action, or say not yet. That is exactly how it works with people. You stop reviewing someone's work when their track record says you can, and you can always start again.

The matrix itself is exportable, which matters more than it sounds. When a security review asks what your AI employee is allowed to do, the answer is not a paragraph about prompt engineering. It is a table: this employee, this tool, this operation, this level, set by this admin, changed on this date. The permission model is the audit artifact.

Autonomy you cannot inspect or revoke is not autonomy, it is exposure. The ladder means the question 'what can it do' always has a precise answer, and 'what should it do next' is a decision you make with evidence in front of you. We would rather ship an employee that starts slower and earns its way up than one that starts impressive and cannot be trusted alone.