Skip to main content
Hive starts by observing and asking. It gains the right to act on its own one action type at a time, only inside limits you set, and never for the actions that matter most. This page explains the vocabulary and the exact order of checks behind every decision. The key idea: the AI model proposes; a deterministic policy engine decides. The model never holds credentials and cannot talk its way past a limit. Every proposed action is a typed request that passes the same rule-based checks before anything happens.

​
Blast radius: how much could go wrong

Every action has a blast-radius tier describing how wide, costly or hard to reverse it is: The review panel turns the tier into a risk word: Low risk (B0), Medium risk (B1–B2), High risk (B3–B4).

​
Reversibility

Hive also classifies every action by whether it can be undone within minutes (the “five-minute undo test”):
  • Reversible — drafts, internal notes, document edits.
  • Compensatable — can be followed by a correcting action: sending an email or message, pausing or resuming, enrolling, escalating.
  • Irreversible — refunds, charges, revoking access, deletions. Any action type Hive does not recognise is treated as irreversible.

​
The autonomy ladder

Each action type sits on one rung: Moving one action type up the ladder never promotes any other. New and high-impact behaviour can stay in Shadow or Approve while proven low-risk work advances.
Five-rung ladder from Shadow to Autonomous with human controls around it.

Autonomy is earned one action type at a time.

​
The decision gate, in order

For every proposed action, Hive’s policy engine checks, in this order:
1

Kill switch

If the workspace kill switch is on, the action is shadowed — recorded, never run. Nothing gets past this.
2

Rung

Shadow → shadowed. Suggest or Approve each → sent to a person for approval.
3

Limits (Auto in limits and Autonomous)

The action may run on its own only if all of these hold: the amount is within the per-action spend cap; the tier is at or below the workspace’s tier threshold; confidence is at or above the confidence threshold; the action is not irreversible; and the hourly action rate, credit budget, per-action and windowed spend caps and error budget all pass. Anything that fails goes to a person instead. If an action type’s error budget is exhausted, it drops one rung.
4

Overrides that always win

Even when everything above passes, Hive always asks a person for B4 actions, for irreversible actions, and for B3 actions below the high-confidence threshold.

​
Default limits

Hive uses these defaults. You can set your own spend caps; the other limits are fixed, and Hive can raise the confidence thresholds (and lower the tier limit to B2) for a while when too many recent automatic actions could not be verified: Owners and Admins can change the spend caps under Money guardrails · hard ceilings on the governance page — see Safety and control.

​
Where you manage autonomy

Open Settings → Governance (the Policy & autonomy page). It has four sections:
  • Decision matrix — an illustration of how confidence and blast radius combine (Auto-run, Ask first, Escalate, Suggest only, Block). It shows Hive’s general priors; the live decision uses the gate above.
  • Blast radius — the tier definitions.
  • Per-action autonomy · the safety ladder — the rung recorded for each action type. Changing a rung needs the Admin or Owner role. Today a change here is recorded as your policy and in the audit trail; the live gate still uses each action’s built-in rung.
  • Money guardrails · hard ceilings — the Per-action cap and Daily cap.
Workspaces taking part in the Signals pilot cannot raise an action type’s rung while the pilot runs: promotions are frozen, and lowering a rung is always allowed.

​
Earned autonomy

Hive notices when your team keeps approving the same kind of action. When the same pattern has been approved three times within 30 days, Hive offers to automate it.
  • Accepting creates an “Auto-run” rule in Learned behaviours. It becomes active straight away, so matching actions run automatically within limits; engaging the kill switch demotes it back to Shadow.
  • An earned automation can rise at most to Auto in limits. It can never reach Autonomous on its own.
  • A Do not run decision, or an action that ran but could not be verified, creates an exception rule telling Hive not to auto-run that shape of action.
You can decline an offer; Hive keeps asking first.
A more rigorous, evidence-based promotion process — minimum numbers of trials per rung and measured success rates — is being prepared. It will only ever propose a change for a person to decide; it never grants autonomy by itself.

​
Promote safely

Before raising an action type’s rung:
  1. review enough completed examples to cover normal and unusual cases;
  2. confirm failures were caught and corrected;
  3. make sure the money and volume limits are explicit;
  4. prefer reversible actions; and
  5. keep sensitive customers and high-blast-radius actions on approval.

Review and approve

Decide on what Hive proposes.

Safety and control

Kill switch, policy page and spend caps.

Audit log

Every action’s receipt.

Learned behaviours

Rules, workflows and exceptions Hive has learned.