An agent role earns its trust level from scored work, but the action it proposes can set a lower ceiling, and one gate-relevant failure can move the role down. A good record can reduce how closely you review routine work. It cannot make a sent email reversible or turn silence into permission.
That distinction drives the Agent Trust Ladder in ROSTER, the operating system The Agent Dream Team teaches. A scorecard measures delivered work against the role’s output contract. The ladder turns a pattern of scores into a named permission and a review cadence. The action class caps that permission. A human gate decides whether a consequential action runs at all. Those are four separate decisions, so record each one separately.
The five levels are my operating design, not a tested reliability scale. No study produced them and none validates them. The book also names a predecessor: a five-rung “AI Agent Trust Ladder” for Amazon sellers was published in May 2026, climbing from observe to recommend to approve to autonomous within guardrails to autonomous with monthly review. I arrived at the shape independently, but the name is not mine and the five-rung idea is not new. The rungs below are defined differently, and that earlier ladder does not validate this one’s thresholds.
What does each trust level permit?
A level belongs to a role, not to the model that runs it. A Research Specialist and an Ops Coordinator can run on the same model and hold different levels, because each has its own charter, output contract, tools and scorecard. Write the level in the first three lines of that charter, above the mandate, where you see it when work arrives.
| Level | Name in the book | What the role may do | Review cadence |
|---|---|---|---|
| L1 | Draft-only | Produces output; the founder reviews everything before it moves on. | Every output |
| L2 | Suggest-with-confidence | Ships output that meets conditions you can check from outside the model; flags the rest for review. | Daily spot-check |
| L3 | Ship-with-notification | Ships routine work and notifies the founder, with a 24-hour recall window. Gate-relevant actions still wait for confirmation. | Weekly review |
| L4 | Ship-and-report | Ships autonomously inside the charter and reports weekly. | Weekly report |
| L5 | Full autonomy | Operates independently inside the charter. | Quarterly |
Read every row as bounded by the charter. L5 does not grant every tool. A quarterly review does not replace the approval a consequential action needs today. And L3’s recall window cannot pull back an email already read or a post already copied.
L2 needs particular care. Its “confidence” is a set of release conditions you can check, never the model’s estimate of itself. A hypothetical Research Specialist might pass an internal brief to the next role only if the brief cites the required number of sources, concerns a client type its charter names and uses the agreed format. A brief that misses one condition waits for you. Confident prose does not clear a condition.
How does a role earn a higher rung?
A new role enters at L1, or at L2 when its onboarding go decision was clean enough to justify it. Chapter 3 gets there in a fixed order: test the charter on known work, probe its boundary on hard work, watch a live task, review an independent run, then decide in writing. The starting level comes out of that week. It is not a vendor default.
Once the role is active, score each output against criteria from its output contract. Log the output, date, criterion scores, release-gate result and current level. One score tells you how one delivery met its standard. A history of comparable deliveries gives you grounds to change a named permission. A high average is evidence for your decision, not an automatic promotion.
The book’s promotion rule asks for four consecutive qualifying review cycles at or above the floor you wrote for the next level, no failure on a gate-relevant criterion in that window, and enough scored outputs inside those cycles to mean something. The book treats four quiet weeks of two outputs each as a default, not a validated guarantee. On a three-level rubric averaged across a week, I use 2.5 as the floor for L2 and L3, and 2.8 for L4 and L5. Those are my numbers on my rubrics, not empirical cutoffs. Write each role’s floor down in a week when nothing is wrong, so that in the week something goes wrong you read a rule instead of negotiating with yourself.
Keep the release gate beside the average, never inside it. A research brief with an unsupported material claim stays blocked even when its other criteria score well. Promotion reduces routine review inside the existing charter. It does not add a tool, widen the mandate or waive a final gate.
Why does the action class set another ceiling?
The level answers one question: how has this role performed on its assigned work? The action class answers another: what is at stake if this action is wrong? Chapter 5 gives each class the highest level a role can reach for it. Scores move a role toward that ceiling, never past it.
| Action class | Example | Highest level for that action | Gate at the ceiling |
|---|---|---|---|
| Read, internal | Read a document or calendar | L5 | Log the access. |
| Read, untrusted source | Search the web or open an uploaded file | L4 | Record the source in the output. |
| Write, private and reversible | Update a private draft folder or task list | L4 | Keep version history; report weekly. |
| Write, shared or costly to reverse | Change a CRM record or shared calendar | L3 | Founder confirms before execution. |
| External, public or financial | Send email, publish, pay or invoice | L3 | Founder confirms every time. |
The book calls the top three rows defaults you can argue with against your own risk tolerance. The bottom two are not negotiable: they restate the ladder’s cap on irreversible, public, financial and legally binding actions. On those actions L3 is a ceiling, not a licence to execute and notify afterwards. The founder confirms the exact action before it runs.
Tool scope is the second dial. An L5 Research Specialist with read-only tools cannot send email, because no send tool is connected to the role. Give it one and you have changed the charter, which resets the role to L2 or below. When you cannot decide which row an action belongs in, the book’s test is blunt: ask what undoing it would cost you at six o’clock on a Friday, and file it there. A shared-calendar change does not become a private, reversible write because the same role may also update its own task list.
What moves a role down or back under direct review?
Promotion needs a pattern. Demotion needs one gate-relevant failure or one weekly average below the floor for the current level. The role drops one rung and keeps working under closer review. Record what failed and the date the level changed. The move describes demonstrated work, not the role’s worth.
A failed gate can also require an immediate hold. In chapter 8, if an output heading to a client, a publication or a consequential decision scores 1 on any criterion, it does not ship until the founder has reviewed and edited it, and the role drops a level at the Friday review. Novel work the charter does not cover, three consecutive weekly averages below 2.0, and legal or reputational sensitivity can each call for a manual override: take a task away from the role, or review every output on delivery, with a written end condition. L1 is the floor of the ladder; an override sits off the ladder until its end condition is met. It does not end the role either. Retiring a production agent is a separate decision.
When the job changes, the old scores no longer describe it. A change to the mandate, output contract, tool list or trigger payload resets the role to L2 or below, and to L1 if the change is structural. A model swap or prompt rewrite runs under restricted review until the new configuration requalifies on the same rubric. A benchmark score for the new model is not a score on this role’s work.
Worked example: one role, two action ceilings
The Ops Coordinator, its charter, scores and calendar mistake are hypothetical. Assume it already holds L3. Its charter allows updates to a private task list and preparation of proposed events for a shared calendar. The founder has already written 2.8 as the floor for L4.
| Review week | Scored outputs | Weekly average | Release gates |
|---|---|---|---|
| 1 | 5 | 2.8 | All pass |
| 2 | 5 | 2.9 | All pass |
| 3 | 5 | 2.8 | All pass |
| 4 | 5 | 2.9 | All pass |
If those twenty outputs represent the role’s normal work, the record meets the book’s promotion rule. The founder records L4 for the role’s ordinary work: routine private task-list updates move from weekly review to a weekly report. The shared-calendar write does not move with them. It stays capped at L3, and each event still needs the founder’s confirmation before the invitation goes out.
Then the coordinator prepares an invitation. The approved brief says 15:00 Amsterdam time; the proposed event says 15:00 UTC. Because the action waits for confirmation, the founder sees the difference before anyone is invited, holds the event and checks the brief and the handoff packet. Under this hypothetical charter the wrong time is a gate-relevant failure, so at the Friday review the role drops from L4 back to L3. If a broken trigger payload caused the mismatch, fixing it is a charter change, and the reset rule takes the role to L2 or below.
The twenty earlier outputs still happened. They do not predict that the twenty-first will be right. The log shows what was earned, what stayed capped and which observation reversed the promotion.
Where does the human final gate remain?
The human final gate sits between an agent’s output and the person or consequential decision it could affect. Chapter 8 applies it to client-facing deliverables, published content, financial communications and commitments, and outputs that feed consequential decisions. The founder reads the exact output before it is sent, published or acted on. As the book puts it: “Trust earns a faster read at the gate. It never earns a skipped one.”
Name the approver and the failure path in the workflow. When nobody approves in time, the request should expire and the action stay blocked; silence is not approval. The stop drill checks whether a named person can interrupt the run and revoke access. A level on a charter proves neither control works in your system.
Review time has a limit too. How many AI agents one person can supervise depends on the review hours you can protect each week. If you cannot keep the cadence, cut the work or the roster. A crowded calendar is not evidence for promotion.
Try this today
Choose one agent role you used this week. Open its charter and its scored-output log. Write four lines at the top of the charter:
- Current level: the rung actually recorded. If none is recorded, treat the role as L1, draft-only, until you write the onboarding decision down.
- Evidence: the scored outputs, review cycles, next-level floor and gate results behind that rung.
- Action ceiling: the most consequential action the role can take, its class, its ceiling and the person who must confirm it.
- Demotion trigger: the one observable result that moves the role down a rung, such as a gate-relevant failure or a weekly average below its current floor.
Then take the role’s most recent proposed action and classify it with the action table. Compare its class with the recorded level and with the tools the role actually holds. If the action needs confirmation, check that it cannot run without the named person’s yes. Where the charter and the workflow disagree, hold that action and fix the boundary first. That is a useful result even if no level changes today.
Cite this:The Agent Trust Ladder: how an AI role earns autonomy.Len P. van der Hof. https://lenvanderhof.com/en/blog/agent-trust-ladder/ ·