Policy-governed autonomy: a more precise description than "human in the loop"

"Human in the loop" gets used by almost every AI vendor right now, and it means almost nothing on its own — it can describe a system where a person reviews every single action, or a system where a person could theoretically intervene but almost never does. We've described our own model that way in the past, and on reflection it undersold what we actually built. The more accurate description is policy-governed autonomy.

What that means concretely

• Every tenant operates in Advisory or Assisted mode, set deliberately, not a single global switch.
• Low-risk, non-destructive, non-irreversible classes of work — routine troubleshooting, a printer offline, a password reset — are eligible for policy-controlled automation within that tenant's configured policy, graduating from one-click-approval to hands-off one class at a time as each earns it.
• Consequential actions — anything destructive, irreversible, or outside the policy's scope — always remain approval-gated, RBAC-enforced, and logged, full stop, regardless of mode.
• Every action, automated or approved, is attributable and audited — there is no autonomous path that skips the audit trail.

The honest claim isn't "a human approves everything." It's "the policy decides what's eligible for automation, and consequential actions are never eligible."

That is a more sophisticated position than blanket "human-approved always" language, and it is also the more accurate one — it describes tenant-scoped policy, a graduated autonomy model, and a hard boundary around irreversible actions, instead of implying every single draft waits on a click forever. Today, autonomous resolution of routine classes still lands for one-click approval in most tenants as that graduation continues; the architecture for policy-controlled, hands-off execution of low-risk classes is what "policy-governed" refers to, and it is what the AI layer is built toward end to end.

We would rather over-explain this distinction than let "human in the loop" quietly become a phrase that means whatever a reader assumes it means. Ask us specifically which classes are eligible for automation in your tenant's policy today — that is a more useful question than "is it human-approved," and it has a specific, current answer.