A single escalator, six steps.
At each step, one more decision moves from design time to run time. Whatever is fixed at design time can be enforced by review, testing, and code. Whatever moves to run time must be enforced by infrastructure the agent cannot reach.
Each level up removes one more thing review can protect you from, and hands it to the network and identity layers. That is the entire purpose of the axis.
Produces information. Holds no tool that changes state.
Everything is fixed at design time. Nothing executes.
An assistant whose output is piped into a script, a ticketing workflow, or another agent is a component of a higher-level system and inherits that system's level. "It only produces text" is not a containment property when something downstream executes the text. The most common misclassification is a summarization or triage agent whose output auto-routes.
Executes a predetermined workflow. No branch the author did not write.
The action set and the sequence are fixed. Only parameter values are decided at run time.
If the model selects the branch, it is L3. Model-filled parameters inside an author-written sequence are still L2, and this is the correct and cheap place for most automation. L2's characteristic failure is parameter injection, not runaway behavior.
Selects among an enumerable, approved tool set within explicit limits.
The action set is fixed. The agent decides which actions, in what order.
L3 collapses the moment the tool set stops being enumerable. Any tool offering arbitrary execution — shell, arbitrary HTTP, code interpreter with network, package installation, arbitrary SQL — makes the effective tool set unbounded. An agent with such a tool is not L3 no matter how the tool list is written. Dynamic tool acquisition at run time (MCP server connection, plugin install, tool discovery) has the same effect. This silently converts an L3 containment design into an L4-or-higher exposure.
Replans when blocked rather than stopping.
The objective and the tool set are fixed. The plan, including recovery from failure, is the agent's.
A blocked L4 agent looks for another way through. That behavior is functionally indistinguishable from an adversary conducting reconnaissance, and it is why "the shortest path runs through systems nobody scoped" is an L4 property rather than a bug. The development agent scenario is L4 behavior.
Decomposes work and delegates it to other agents.
The objective and the sub-agent roster are fixed. The plan, and who executes it, are decided at run time.
An orchestrator that can spawn an L4 agent is at least L4, and its effective authority is the union of its sub-agents' authority. Containment drawn around the orchestrator while sub-agents execute elsewhere is not containment. The characteristic L5 failure is authority laundering: the sub-agent receives a fresh grant rather than a subset of the parent's, and the boundary resets to zero one layer down.
Operates over long periods, in broad environments, with minimal supervision.
Only the release conditions are fixed. Objective, plan, actor, duration, and environment are all run-time. There is no natural point at which the work ends.
Every expiry-based and teardown-based control in CUSTODY assumes an assignment that ends. L6 systems do not have one, so their credentials, environments, and artifacts do not either. See the epoch model below.
If the work does not end, impose a boundary anyway
Continuous validation platforms, always-on operational agents, and long-lived monitoring agents run indefinitely. Run them instead as a chain of epochs, which converts an unbounded system into a sequence of bounded assignments.
- An epoch has a hard maximum wall-clock duration, set by policy, not by the agent or the work.
- At epoch close: identity is revoked, secrets rotated, the execution environment destroyed and rebuilt, and artifacts reconciled against the creation log.
- Starting the next epoch requires a re-authorization event, not a restart.
- Task state may persist across epochs, in an external store the agent does not control. Authority and execution environment may not.
- Any conditions change between epochs is a governed authorization event.
Shorter epochs cost operational friction and buy containment. The epoch boundary is also the only mandatory supervision checkpoint an L6 system has, since there is no assignment completion to serve as one. Treat an L6 system that cannot tolerate epoch boundaries as an L6 system that has not been architected for containment, and say so in the risk acceptance.
Six delegation rules, stated as arithmetic
They are stated as arithmetic because they must be enforced as arithmetic, not as guidance. The rules constrain children against the parent's authorized level ceiling, the value declared in the profile record at authorization time, since constraining against effective level would be circular.
-
Authority is a subset, never a superset and never a fresh grant
A sub-agent's conditions artifact must be derived from the parent's by restriction. If the delegation mechanism can mint new authority, the model is defeated at the first hop.
-
Level does not increase downward
A child's authorized level ceiling is at most the parent's. Whether recursive delegation is permitted is a separate declared flag, not an inference.
-
Mandate does not broaden downward, and mandate rigor does not narrow downward
An operational parent cannot spawn an adversarial child. Equally, an adversarial parent spawning an observational child does not get to drop that child to detection-based containment: the child sits inside a hostile engagement. Authorized breadth narrows downward. Required control rigor is the maximum across the tree.
-
Reach does not expand downward
A sub-agent inherits the parent's reach ceiling or narrower.
-
Expiry is inherited, not reset
A sub-agent's authority expires no later than its parent's. Delegation cannot be used to extend a clock.
-
The restriction is total
Every field of the conditions artifact is either narrowed or inherited unchanged. A field the restriction function does not mention is inherited, never defaulted and never re-authored. A partial restriction function is a fresh-grant mechanism with extra steps.
The orchestrator's own effective profile is the ceiling of the tree, not the description of its root. Compute it that way, contain to it, and report it that way. Where the computed effective profile exceeds the authorized profile, that is level drift and an incident, not a reclassification. Depth and fan-out are bounded, declared, and decrementing, and enforced by the platform rather than requested of the agent.