Every autonomous system eventually meets a decision it should not make alone. The difference between a useful agent and a dangerous one is whether that moment was designed in advance.
Authority is not a mood. It is a boundary, set before execution begins, that says: these actions are yours, these require a person. When the boundary is explicit, escalation stops being an interruption and becomes part of the operating rhythm — the system doing exactly what it was told.
Most failures we see in agent deployments trace back to an implicit boundary. The agent was trusted “in general,” which means the limits were discovered in production, one incident at a time. A boundary you cannot write down is a boundary the system cannot enforce.
“Escalation is not the system failing. It is the system working.”
So when should an agent stop and ask? In practice, three conditions cover nearly every case. Each is measurable, and each belongs in the objective’s definition — not in the agent’s judgment at runtime.
Notice what is not on the list: novelty, ambiguity, discomfort. Agents handle unfamiliar territory constantly; that is the job. The signals that matter are the ones a reviewer would recognize after the fact — could we have undone it, how sure were we, what did being wrong cost.
The gate itself must carry context: what the agent knows, what it tried, why it stopped. A question without evidence is just an interruption. A question with the record attached is a decision half-made — the person reviews, decides, and the run continues with that decision recorded like any other action.
This is what we mean when we say the handoff is the product. Not a fallback for when autonomy runs out — the designed seam where machine execution and human judgment meet, on purpose, with the paperwork already done.