> ## Documentation Index > Fetch the complete documentation index at: https://docs.get-hive.ai/llms.txt > Use this file to discover all available pages before exploring further. # Autonomy and blast radius: when Hive acts on its own > How Hive decides whether to observe, ask or act: blast-radius tiers B0-B4, the five-rung autonomy ladder, the decision gate, default limits and earned autonomy. Hive starts by observing and asking. It gains the right to act on its own one **action type** at a time, only inside limits you set, and never for the actions that matter most. This page explains the vocabulary and the exact order of checks behind every decision. The key idea: **the AI model proposes; a deterministic policy engine decides.** The model never holds credentials and cannot talk its way past a limit. Every proposed action is a typed request that passes the same rule-based checks before anything happens. ## Blast radius: how much could go wrong Every action has a **blast-radius tier** describing how wide, costly or hard to reverse it is: | Tier | Meaning | Examples | | - | - | - | | **B0** | Invisible or reversible | Update a fact, write a draft | | **B1** | Internal-facing | Post in Slack, create a task | | **B2** | External, cheap to fix | Email a known contact | | **B3** | External, hard to reverse | Message a VIP, send in bulk | | **B4** | Money, legal or irreversible | Issue a refund, revoke access | The review panel turns the tier into a risk word: **Low risk** (B0), **Medium risk** (B1–B2), **High risk** (B3–B4). ## Reversibility Hive also classifies every action by whether it can be undone within minutes (the "five-minute undo test"): * **Reversible** — drafts, internal notes, document edits. * **Compensatable** — can be followed by a correcting action: sending an email or message, pausing or resuming, enrolling, escalating. * **Irreversible** — refunds, charges, revoking access, deletions. Any action type Hive does not recognise is treated as irreversible. ## The autonomy ladder Each action type sits on one rung: | Rung | Label | What Hive may do | | - | - | - | | `shadow` | **Shadow** | Observe and record what it would have done. Never acts. | | `suggest` | **Suggest** | Surface the finding and recommend a response for a person to review. | | `approve` | **Approve each** | Prepare the action and wait for an authorised person. | | `auto-limits` | **Auto in limits** | Act on its own, but only when every limit below passes. | | `autonomous` | **Autonomous** | Act without routine approval — still inside every limit and override. | Moving one action type up the ladder never promotes any other. New and high-impact behaviour can stay in Shadow or Approve while proven low-risk work advances. Five-rung ladder from Shadow to Autonomous with human controls around it. ## The decision gate, in order For every proposed action, Hive's policy engine checks, in this order: If the workspace kill switch is on, the action is **shadowed** — recorded, never run. Nothing gets past this. **Shadow** → shadowed. **Suggest** or **Approve each** → sent to a person for approval. The action may run on its own only if **all** of these hold: the amount is within the per-action spend cap; the tier is at or below the workspace's tier threshold; confidence is at or above the confidence threshold; the action is not irreversible; and the hourly action rate, credit budget, per-action and windowed spend caps and error budget all pass. Anything that fails goes to a person instead. If an action type's error budget is exhausted, it drops one rung. Even when everything above passes, Hive **always** asks a person for **B4** actions, for **irreversible** actions, and for **B3** actions below the high-confidence threshold. ### Default limits Hive uses these defaults. You can set your own spend caps; the other limits are fixed, and Hive can raise the confidence thresholds (and lower the tier limit to B2) for a while when too many recent automatic actions could not be verified: | Limit | Default | | - | - | | Spend cap per action | £5,000 | | Spend cap per window (daily) | £25,000 | | Automatic actions per hour | 1,000 | | Confidence threshold | 0.70 | | High-confidence threshold (for B3) | 0.85 | | Highest tier allowed to run automatically | B3 | Owners and Admins can change the spend caps under **Money guardrails · hard ceilings** on the governance page — see [Safety and control](/admin/safety-and-control). ## Where you manage autonomy Open **Settings → Governance** (the **Policy & autonomy** page). It has four sections: * **Decision matrix** — an illustration of how confidence and blast radius combine (Auto-run, Ask first, Escalate, Suggest only, Block). It shows Hive's general priors; the live decision uses the gate above. * **Blast radius** — the tier definitions. * **Per-action autonomy · the safety ladder** — the rung recorded for each action type. Changing a rung needs the **Admin** or **Owner** role. Today a change here is recorded as your policy and in the audit trail; the live gate still uses each action's built-in rung. * **Money guardrails · hard ceilings** — the **Per-action cap** and **Daily cap**. Workspaces taking part in the Signals pilot cannot raise an action type's rung while the pilot runs: promotions are frozen, and lowering a rung is always allowed. ## Earned autonomy Hive notices when your team keeps approving the same kind of action. When the same pattern has been approved **three times within 30 days**, Hive offers to automate it. * Accepting creates an "Auto-run" rule in [Learned behaviours](/brain/learned-behaviours). It becomes active straight away, so matching actions run automatically within limits; engaging the kill switch demotes it back to Shadow. * An earned automation can rise at most to **Auto in limits**. It can never reach **Autonomous** on its own. * A **Do not run** decision, or an action that ran but could not be verified, creates an exception rule telling Hive not to auto-run that shape of action. You can decline an offer; Hive keeps asking first. A more rigorous, evidence-based promotion process — minimum numbers of trials per rung and measured success rates — is being prepared. It will only ever *propose* a change for a person to decide; it never grants autonomy by itself. ## Promote safely Before raising an action type's rung: 1. review enough completed examples to cover normal and unusual cases; 2. confirm failures were caught and corrected; 3. make sure the money and volume limits are explicit; 4. prefer reversible actions; and 5. keep sensitive customers and high-blast-radius actions on approval. ## Related Decide on what Hive proposes. Kill switch, policy page and spend caps. Every action's receipt. Rules, workflows and exceptions Hive has learned.