What agentic operations is

An agentic-operations standard states a thesis, a scope, and one rule that governs every agent in the fleet. Cogitave's agentic-operations standard is the worked example; here is what it says, and what you would decide when you write your own.

The thesis and scope

A certification-grade, AI-native company should run its own back-office and go-to-market the same way it ships software: agents do the high-frequency, low-context, reversible work, and humans hold every consequential gate.

The standard does not claim a fully autonomous company. It claims a co-pilot estate: agents draft, triage, reconcile, enrich, summarize, and propose; humans decide. Cogitave's scope draws the line across five business domains - marketing, RevOps/sales, customer support, finance/FinOps, and operations/incident-response. In its instance, engineering automation (PR triage, dependency review, security triage, docs sync) is explicitly out of scope here; it is governed instead under agents/scheduled/ and its own specs, though it satisfies the same contract below. When you set your own scope, the split of concern matters more than where exactly you draw it.

The three-part contract every ops agent satisfies

Section 2 makes an ops agent's identity concrete. It is not a script or a shared login; it MUST be:

1. A first-class identity with a least-privilege capability grant - an immutable UID, a workload identity, and an explicit grant scoped to a run_id. It uses only the tools/resources its grant names; if a task needs more, it requests a grant change through a human rather than working around the boundary.
2. Run inside the request lifecycle - every consequential action is a Request moving through the seven stages, and the write tools are propose-only: they open an issue/PR and stage a draft, never apply or mutate protected state.
3. Gated by the eval harness on four axes - accuracy, coverage, safety, and latency - before any behavior change ships; safety scenarios default to a single failure blocking release.

The draft-vs-act rule

This is, in the standard's own words, "the single most important rule" - and it is the heart of the transferable pattern: an agent acts unattended inside its rails, and a human gate is an exception handler, not a routine checkpoint.

Default: the agent ACTS autonomously within its grant when the rails hold - typed and validated I/O, policy-as-code, a reversible or canaried effect under a blast-radius cap, and a green eval gate. It ESCALATES to a human on an exception: a guardrail or check fails, confidence is low or the case is novel, drift or a policy violation is detected, or the action falls in the minimal always-human set. Proposing is the exception path, not the default over every correct action.

The standard places that split on a spectrum of consequence and reversibility:

The must-human-gate boundary never runs unattended: irreversible decisions, policy violations, all customer-facing communications, contract interpretation, budget or payment approval, compensation/hiring decisions, external commitments, and any novel scenario past the confidence threshold. In Cogitave's instance these map directly to the org floor - agents do not publish, pay, deploy, apply infra, rotate secrets, disclose data, or change org settings without an explicit human gate. Any org adopting the pattern draws its own version of that same minimal, always-human set.