{
  "uid": "cogitave.learn.run-agentic-operations.what-agentic-operations-is",
  "kind": "moduleUnit",
  "href": "/modules/run-agentic-operations/what-agentic-operations-is/",
  "title": "What agentic operations is",
  "summary": "",
  "type": null,
  "products": [],
  "roles": [],
  "levels": [],
  "subjects": [],
  "headings": [
    "The thesis and scope",
    "The three-part contract every ops agent satisfies",
    "The draft-vs-act rule"
  ],
  "source": "The [agentic-operations](../../../../standards/docs/standards/agentic-operations.md)\nstandard states a thesis, a scope, and one rule that governs every agent in\nboth catalogs.\n\n## The thesis and scope\n\n> A certification-grade, AI-native company should run its own back-office and\n> go-to-market the same way it ships software: agents do the high-frequency,\n> low-context, reversible work, and humans hold every consequential gate.\n\nThe standard does **not** claim a fully autonomous company. It claims a\n**co-pilot estate**: agents draft, triage, reconcile, enrich, summarize, and\npropose; humans decide. Its scope is business operations across five domains -\nmarketing, RevOps/sales, customer support, finance/FinOps, and\noperations/incident-response. Engineering automation (PR triage, dependency\nreview, security triage, docs sync) is explicitly **out of scope**; it is\ngoverned instead under [`agents/scheduled/`](../../../../agents/README.md) and\nits own specs, though it satisfies the same contract below.\n\n## The three-part contract every ops agent satisfies\n\nSection 2 makes an ops agent's identity concrete. It is not a script or a\nshared login; it MUST be:\n\n1. A **first-class identity with a least-privilege capability grant** - an\n   immutable UID, a workload identity, and an explicit grant scoped to a\n   `run_id`. It uses only the tools/resources its grant names; if a task needs\n   more, it requests a grant change through a human rather than working around\n   the boundary.\n2. **Run inside the request lifecycle** - every consequential action is a\n   `Request` moving through the seven stages, and the write tools are\n   **propose-only**: they open an issue/PR and stage a draft, never `apply` or\n   mutate protected state.\n3. **Gated by the eval harness** on four axes - accuracy, coverage, safety, and\n   latency - before any behavior change ships; safety scenarios default to a\n   single failure blocking release.\n\n## The draft-vs-act rule\n\nThis is, in the standard's own words, \"the single most important rule\":\n\n> **Default: the agent ACTS autonomously within its grant when the rails\n> hold** - typed and validated I/O, policy-as-code, a reversible or canaried\n> effect under a blast-radius cap, and a green eval gate. **It ESCALATES to a\n> human on an exception**: a guardrail or check fails, confidence is low or the\n> case is novel, drift or a policy violation is detected, or the action falls\n> in the minimal always-human set. Proposing is the exception path, not the\n> default over every correct action.\n\nThe standard places that split on a spectrum of consequence and reversibility:\n\n| Loop placement | When it applies | Examples |\n| --- | --- | --- |\n| Human-OUT-of-loop | Read-only analysis or bounded, reversible internal effects | Triage/classification, tagging, enrichment, duplicate detection, summarization |\n| Human-ON-loop | Externally visible or hard-to-reverse; default for mutation | Open a PR/issue, draft a customer reply, queue a campaign, propose a CRM merge |\n| Human-IN-loop | Irreversible, high-blast-radius, money, identity, or policy-sensitive | Publishing external content, paying an invoice, changing pricing, anything flagged by a safety eval |\n\nThe **must-human-gate boundary** never runs unattended: irreversible\ndecisions, policy violations, all customer-facing communications, contract\ninterpretation, budget or payment approval, compensation/hiring decisions,\nexternal commitments, and any novel scenario past the confidence threshold.\nThese map directly to the org floor - agents do not publish, pay, deploy,\napply infra, rotate secrets, disclose data, or change org settings without an\nexplicit human gate.\n\n> [!TIP]\n> When a gated action does reach a human, it must arrive as a **15-second\n> evidence pack**: what the agent wants to do, the inputs/citations it used,\n> the predicted effect, the reversibility, and its confidence - role-routed to\n> the right approver, who can approve, approve-with-edits, or deny.\n",
  "partOf": "cogitave.learn.run-agentic-operations",
  "durationInMinutes": 8,
  "quiz": null
}