Development record

A human-set autonomy grant permits, separately from the agent-written waiting-on badge

adrproposedadr-2610240850193281

Context

abcd mode carries two things. The badge (managed, facilitator, product-thinker) reports whose answer the loop is waiting on; a question's chip sets it and the answer resets it, so in practice the agent writes it. The away mode (abcd mode autonomous, queue, back, itd-2610180912189125) records that the person is away and grants no rights: no reader in build, implement, drain or landing consults it, and --hold-pushes changes only the stop hook's wording. The one setting meant to grant something, facilitator.mode: auto|human (adr-2610150603484802), lives in the repository's config and is not built.

The away mode first granted a narrow right, a session pushing its own branches and opening their pull requests (dcn-2610181003456444). dcn-2610181016510153 reversed it: the OS sandbox fences only the agents abcd's runner launches, never the person's own interactive sessions, so guard entries "would never become a boundary" and would buy "a trust claim the plan cannot make".

The consequence surfaced on 2026-10-24: a session refused to push a branch and open a pull request without a standing permission, and the person found no setting that gives one. The permission lived only in chat.

State of the art, read on 2026-10-24: Claude Code's permission modes, Codex's approval and sandbox presets, Cline's auto-approve toggles and LangChain's per-tool interrupts are all grants the harness enforces, none of them an OS boundary for the person's own session. Each is kept apart from the session's "needs input" status (Claude Code's agent view states the separation), each is built from per-capability grants with named presets on top, and each keeps a short list of irreversible acts gated at every level (force-push, merging an unapproved pull request, production deploys; GitHub's coding agent cannot merge at all). None of them expires a grant on a clock.

Decision

We will treat a grant and a fence as different things. A grant says what a session may do without asking; it needs no sandbox, because it widens nothing the session could not already do and only removes the stop. A fence restricts, and stays a mistake filter where abcd cannot enforce it (adr-42), as --hold-pushes already is.

We will therefore give the person one autonomy grant, kept apart from the badge:

The person alone sets it, by an explicit command (/abcd:mode autonomous, or abcd mode autonomous at a terminal), never from a sentence in chat, and it lives in their home (~/.abcd.noindex/), keyed on the repository's root commit. A repository's committed .abcd/config.json may remove a capability from it and never add one.
It is built from push-branch, open-pr and decide-as <role>, with three presets on top (nothing, ship-work, everything); a grant that names none carries ship-work (push-branch, open-pr, decide-as facilitator).
On the grant alone, abcd's own commands refuse merging to the default branch and cutting a release, and the guard filters the shell routes to them where its hooks run. A release or merge the person asks for in the session is the person's act, not the grant's, and is not refused. A session never force-pushes, even on the person's word: the person runs it in their own terminal.
It ends at a time the person names, or seven days after it was set; an ended or unreadable grant reads as no grant.
It holds whether the person is present or away: being away stays its own record, and ending the absence does not end the grant.
It reaches a session only through abcd's hook output, and is checked again at each push and pull request, so where abcd's hooks do not run there is no grant.
Only the person sets it: the guard refuses a session that sets or writes it, by every route abcd can be invoked through.
The badge stays the agent's report of whose answer is owed; the status line shows the grant beside it.

Whether abcd may merge on its own (queue-merge, and the repository's planned facilitator.mode: auto) and what a cloud session may do are not decided here; they are itd-2610241015120503's, because each would reverse an accepted rule (ruling AM1 in the landing's merge gate, adr-2610150603484802, invariant 23).

This reverses dcn-2610181016510153 in whole, on rights and on who sets the mode (it let a session set it "on their word"), and reinstates dcn-2610181003456444's person-only guard with a wider grant; dcn-2610241016208164 records the reversal from the decisions' side.

The grant and the fence are two axes, as Codex keeps its approval policy apart from its sandbox mode. Where abcd puts up a fence, the grant is embedded in it: the agents abcd's runner launches run inside the operating-system sandbox of itd-2610161621364075, and the grant says what they may do there without asking. Where abcd cannot fence, the person's own interactive sessions (the part B that intent names for a draft of its own), the grant stands alone, abcd claims no boundary, and the person's host settings stay the outer fence (product thinker, planning interview, 2026-10-24).

Alternatives Considered

Keep the away mode as a record that grants nothing (the standing decision). Rejected: the person's permission then lives in chat, one session hears it and its peers do not, and compaction can drop it. Every tool examined ties the human control to what the agent may do.
Grant rights only where abcd can fence them (the runner's sandboxed agents). Rejected: it leaves the person's interactive sessions, the ones that paused on 2026-10-24, with no grant at all.
A single autonomy level (off, low, full). Rejected: every tool examined builds its levels from per-capability grants, and a single level cannot say "push and open pull requests, but do not decide product questions".
Per-capability grants with named presets, irreversible acts outside every preset (chosen). It matches the state of the art and keeps the acts the person cannot undo with the person.

Consequences

A session may push its own branch and open a pull request under a grant without asking, and the morning list must name what it did.
abcd takes on a refusal it does not have today: on the grant alone, its own commands refuse merging to the default branch, a release cut and a force-push, with the guard as the shell-side mistake filter.
The shipped away mode's "or asking a session to" route is withdrawn: a breaking change for anyone who sets it in prose.
The badge loses its human writer on the /abcd:mode page; the page leads with the grant.
The grant is a permission, not a sandbox: a session that ignores it is not stopped by it, and the documentation says so.

Frontmatter

id	adr-2610240850193281
type	adr
status	proposed
date	2026-10-24

.abcd/development/decisions/adrs/2610240850193281-a-human-set-autonomy-grant-permits.md
open on GitHub ↗ · commit history ↗

References9

adr-42The guard's parse layer is a mistake filter, not a security boundary — matching is two-tier, and completeness is abandoned as a goalrelated
adr-2610150603484802A fresh install's facilitator is a person until the repository says autorelated
itd-97The Facilitator Is a Mode, Not a Personrelated
itd-2610150602547271The facilitator's mode gates the mergerelated
itd-2610161621364075The agents abcd launches on its own work inside a sandbox the operating system enforcesrelated
itd-2610170638184486Every session keeps a checklist on disk, so no run stalls and no stall spreadsrelated
itd-2610180912189125A session left to work on never stops while it has workrelated
itd-2610240850336695The person grants their sessions what they may do alone, until a timerelated
itd-2610241015120503The person and the repository agree when abcd may merge, and what a cloud session may dorelated

Referenced by2

adr-2611011327164895A self-attested result is labelled as such, and only the person switches it on, by an act abcd's own verbs refuse to its agentsrelated
adr-2611050740453233A stop is recorded state a person sets, and one shared folder is the exception to the owner-only storerelated

mentions7

dcn-26101810034564442026-10-18 — Only the person sets the away mode, its push rights are narrow, and the guard's refusal is a mistake filter (facilitator-on-delegation, itd-2610180912189125 review round 2, choice (a); refines dcn-2610180913399042, replacing its clause that an agent sets the mode on the person's word): the prompt hook cannot tell the person's message from one another session relays, and its input names no origin, so a relayed word could let an agent grant itself, and every copy, push rights. So the guard refuses every route to setting the mode that it reads: `abcd mode autonomous` by the binary on PATH, the plugin root's binary or a built `abcd-<goos>-<arch>`; a `go run` of a package ending in `cmd/abcd`; any of them inside `sh -c` or in a script file a shell runs (adr-2610091150447054); a shell write into the away store under `~/.abcd.noindex/away/`; and an Edit or Write tool call on a path inside it. The person sets the mode with their own `!` command, which the host runs directly without going through Claude and so without the pre-tool hook, or at a terminal. A refused attempt is recorded in the store and shown to the person on the next prompt. What the mode grants is the session committing and pushing its own branches and opening their pull requests; never the default branch, a tag, a release cut, another person's pull request, a branch this copy only checked out to review, or a force push; merging follows the repository's own rule. This is chosen over the fallback, and is enough for now, because the grant only governs an agent that follows refusals: one that ignores them can push without any mode, so no shape of the mode adds a boundary inside the person's own session; the guard stops a refusal-following agent from granting itself on a relayed word; the rights are narrow, and every push is reversible and visible on the forge; and the record (who set it and from which copy) and the recorded refusals leave a trail the person reads on return. The guard stays a mistake filter (adr-42, and the decision of 2026-10-17 on the default branch that keeps the headless approver one, naming the OS fence as the boundary). That fence (spc-2610161751056096) is the boundary only for agents abcd's runner launches, whose writes to abcd's home it confines to their own worktree; it does not fence the person's own interactive session, where the stall happened, so there the narrow grant and the trail are the mitigation. The fallback (the mode grants no push rights, and the person's own standing instruction stays the authority to push) applies instead if the live capture shows that a message relayed from another session can run as a `!` command, or that an agent's tool call can reach the host's shell mode (grounds: plan review round 2, choice (a), and the coordinator's two addenda; the host's interactive-mode page, which says shell mode runs commands directly without going through Claude and outside the sandbox that applies to Claude's commands; the abcd-source-ledger-flip guard entry; adr-2610161621415708)
dcn-26101810165101532026-10-18 — The away mode grants no push rights: the person's own standing instruction stays the authority to commit, push, and open or merge a pull request, exactly as before the mode existed (facilitator-on-delegation on the release orchestrator's ruling, itd-2610180912189125 after plan review round 2; supersedes dcn-2610181003456444, round 2's choice (a), and with it the guard entries that made setting the mode the person's act alone). The OS sandbox of spc-2610161751056096 fences only the agents abcd's runner launches, never the person's own interactive sessions, so for the sessions that actually stalled on 2026-10-16 the guard entries would never become a boundary, and their two days would buy a trust claim the plan cannot make. The fallback dcn-2610181003456444 already named is taken now, not on the live capture's evidence. Where the stop check finds owed work that needs a push (an unpushed branch, a reservation whose work no pull request carries, a behind or failing pull request once its local fix is committed), its reason tells the session to push if its standing instruction allows, and otherwise to queue the push with abcd mode queue for the person's return; a queued step that names the item's branch or record id, on word boundaries, hands that item back to the person for the rest of the window (a branch only while it holds commits its upstream lacks, so only the push waits), and the stop check stops naming it. The away mode is never treated as permission. The person-only acts gain pushing, opening or merging a pull request without a standing instruction that allows it. Who sets the mode returns to dcn-2610180913399042: the person, or a session on their word in that session; since the mode grants nothing, a mode set on a relayed word only keeps sessions working and deciding instead of asking, and the person sees who set it, from which working copy, and the literal abcd mode back on their next prompt. Making the mode the person's act alone moves to itd-2610170638184486 as named remaining work: the guard entry refusing an agent's abcd mode autonomous, its other routes (sh -c and script files), the shell-write and file-tool refusals on the away store, the refused attempts recorded and shown, the capture's checks of the person's ! command and of a relayed !, and the guard reading go run ./cmd/abcd and built abcd-<goos>-<arch> binaries as abcd for every entry, the ledger flip included, a security-relevant widening that gets its own review there (grounds: the release orchestrator's ruling of 2026-10-18 and the reviewer's addendum, both recommending the fallback; spc-2610161751056096 and adr-2610161621415708, which fence launched agents only; iss-2610170619247185, whose standing instruction already allowed pushes and auto-merge; the fallback clause of dcn-2610181003456444)
dcn-26102410162081642026-10-24 — dcn-2610181016510153 is reversed in whole by adr-2610240850193281: the away mode no longer grants nothing, and a session no longer sets it on the person's word. A person-set autonomy grant now permits pushing a session's own branches, opening their pull requests and answering its own questions as a named role, set only by the person's explicit command; dcn-2610181003456444's person-only guard is reinstated with that wider grant (itd-2610240850336695). The reversal's grounds: a grant only removes a stop and needs no fence, which the reversed decision's boundary argument did not separate.
itd-2611011325428560A solo private repo can self-attest its gates, labelled so
itd-2611041549461012A session that takes over a run steps on from what abcd wrote down
itd-2611041549471712A person stops the unattended runs of each account that chose a folder, with one command
itd-2611041549483696An unattended run writes one private daily digest page