Every team building with LLMs eventually asks the same question: when do we let it act on its own? Most answer with a date. “We’ll enable auto-mode once it’s ready.” Readiness, in my experience, is not a date. It is a ladder — and every rung has to be earned with evidence from the rung below.
I run several production AI systems end to end: a spec-to-code engine that opens reviewed pull requests, a daily multilingual content pipeline that drafts, verifies, and publishes on a schedule, and a report-publishing pipeline on AWS Step Functions and Bedrock. They sit on different stacks and serve different masters, but they all climbed the same four rungs. This essay is that ladder, with the scars that paid for it.
Rung 0 — the model drafts, you do everything else
This is where every system must start, and where most demos pretend they didn’t. The LLM produces; a human reads every word, checks every number, presses every button. Boring, slow — and irreplaceable, because this rung has one job: teaching you the failure modes. Not the theoretical ones from someone’s blog — yours. The model that returns a list where you expected a string. The number that is mathematically true but derived rather than sourced. The hallucinated enthusiasm in a domain where enthusiasm is a compliance incident.
You cannot design gates for failure modes you have not met. Rung 0 is where you meet them.
Rung 1 — deterministic gates catch what you’ve met
Once a failure mode has a face, it gets a gate. The word deterministic matters more than any other in this essay. A gate is not another model with an opinion; it is arithmetic. In my report pipeline the model must return, next to its prose, a block of every figure it used. The gate recomputes each one from the source data and compares — equality, not vibes. Every number that appears in the narrative must exist in that verified block. Dates are checked against the source. Shapes are checked against the schema.
The most instructive moment I’ve had with this: the gate once rejected a sentence that was true. The model wrote that volatility sat “37% above the benchmark” — a correct derivation from a verified ratio of 1.37×. The gate killed it anyway, because the number wasn’t in the sourced set. That felt pedantic for about a minute, until the obvious sank in: derivation is exactly where models slip. A gate that admits true-but-unverifiable claims is a gate with a hole in it. Verification doesn’t split statements into true and false; it splits them into provable here and not. Reject the second kind and let the model rephrase — with feedback, it converges in one retry.
Rung 2 — the human approves by exception
With gates holding, the human’s job changes from doing to deciding. The system drafts, verifies, prepares everything — and stops. One message arrives with a preview and two buttons. Nothing ships without the click.
Two properties make this rung honest. First, the approval must be cheap — if saying yes takes more than ten seconds, you’ll batch approvals, then rubber- stamp them, then stop reading. A preview and a button, on whatever device the human actually holds. Second, it must be real — the button is the only path to production, not a courtesy notification racing an automatic timer. Decision tokens in my systems are one-shot: a spent approval politely refuses to fire twice. No double publishes, no replayed clicks.
Rung 3 — the clock acts, silence is consent
The last rung inverts the default. The system publishes on schedule; the human intervenes only to stop it. This is the rung everyone wants on day one and nobody should have before earning it — because the prerequisites are the previous rungs’ track record: gates with a catch history you can show, approvals whose previews you stopped needing to correct months ago.
Even then, three things stay non-negotiable. Stop-cranes — postpone and skip controls that work in one tap, because autonomy without a brake is not engineering, it’s faith. A failed gate halts the autopilot — the system’s own verification outranks its own schedule, always. And journaling — every call logged with tokens, cost, latency, stop reason. My telemetry once caught a model silently burning its entire output budget on hidden reasoning and returning nothing; the journal turned a would-be mystery into a five-minute diagnosis. You cannot govern what you cannot see.
Autonomy is per action, not per system
The subtlety that took me longest: the ladder is not climbed by systems, it is climbed by actions. In the same pipeline, publishing to my own site reached rung 3 within days — the blast radius of a mistake is an embarrassing hour. Posting to external platforms still lives at rung 2, deliberately, because external actions are harder to unwind and carry someone else’s trust. One system, different rungs for different verbs. Anyone selling you system-level “full autonomy” is averaging over verbs that should never share a number.
Trust as an operational property
I once wrote that a loop that only knows how to continue is just an infinite prompt with better branding. The ladder is how a loop acquires the thing it actually lacks — judgement — without pretending the model has it. The judgement lives in the gates you wrote after real failures, in the approval a human actually reads, in the brake that actually works.
Built that way, trust stops being a feeling and becomes an operational property — measured in catch rates and audit trails, promoted rung by rung on evidence, demoted the moment the evidence turns. Which is to say: trust in AI systems is built the same way we’ve always built uptime. Nobody believes in five nines. They engineer them.