The problem is the middle

Agentic systems fail in the middle

Full human review does not scale. Full autonomy is not trusted. Real work sits in the long stretch between the two, where a task has earned some autonomy but not all of it, and the hard question is never "can the agent act" but "can we trust it to act this time, without a human."

PAA is a task contract for the space between manual review and unsafe autonomy: a bounded unit of work whose output is evaluated, gated, logged, and allowed to earn or lose autonomy from the evidence record. Autonomy should be earned, scoped, and revocable.

A task contract, above the fold

refund_approval is the canonical public example — the five-group contract shape.

Boundary

Input: refund_request. Output: decision.

Evidence log

request, proposal, verdict, decision, chargeback_signal, complaint_signal, review

Evaluator

Target

output

Technique

escalation_classifier

Oracle

human_gold

Position policy

hitl: blocking — approve each decision before it executes
hotl: async — review batch after execution
autonomous: offline — periodic spot checks

Promotion rule

Metric: recall_on_should_escalate. Threshold: >= target. Window: rolling_N_cases.

Demotion

Rule: Condition: chargebacks_or_complaints_exceed_bound. Window: 1.
Fallback: human_review

refund_approval YAML example

task: refund_approval
boundary:
  input: refund_request
  output: decision            # approve | escalate
evidence_log:
  - request
  - proposal
  - verdict
  - decision
  - chargeback_signal
  - complaint_signal
  - review
evaluator:
  target: output
  technique: escalation_classifier
  oracle: human_gold          # labeled escalation decisions
  position_policy:
    hitl: blocking            # approve each decision before it executes
    hotl: async               # review batch after execution
    autonomous: offline       # periodic spot checks
promotion_rule:
  metric: recall_on_should_escalate
  threshold: ">= target"
  window: rolling_N_cases
demotion:
  rule:
    condition: chargebacks_or_complaints_exceed_bound
    window: 1                 # point demotion
  fallback: human_review

A task is not eligible for the spectrum at all until it is instrumented at its boundary. If you cannot observe it, you cannot measure it; if you cannot measure it, you cannot gate it; if you cannot gate it, you cannot responsibly automate it.

The evaluator is the primitive

PAA separates capability from authority. A model may be capable of producing an action, but the system still needs an evaluator to decide whether that action is allowed.

The evaluator is defined by four choices: the target (what gets evaluated — input, process, output, or outcome), the technique (what produces the verdict — rule, metric, classifier, LLM judge, or human), the oracle (what the verdict is checked against), and the position policy (how the gate behaves at each spectrum region). Oracle and position policy belong to the evaluator because they are properties of the verdict producer.

The full taxonomy, technique catalog, and maturity curve live on Evaluators. The illustrative declaration rendering lives on Framework.

Start here

A map of the framework — concepts, mechanism, and how to build it.

Agentic systems fail in the middle

refund_approval

Manifesto

Evaluators

Flows

Grounding

Framework