Enterprise security teams are saying out loud what product leaders have been improvising: separate the supply of intelligence from the authority over it. The model proposes. Controls outside the model decide what it may access, what it may do, and whether it should keep running. Asking the model to be its own security authority is a category error — the same class of error as letting a feature decide its own rollback owner.
The failure pattern is not a dramatic jailbreak. It is quiet authority leak. An agent inherits the sponsor's standing permissions. A demo connector stays on after the pilot. Memory expands without a freshness SLA. Risk rises mid-task — a prompt injection, a drifted plan, a write that was never on the contract — and nobody can narrow or stop the agent in minutes, because stop authority was never a named product surface. Capability scaled. Containment did not.
Agent Autonomy Tiers are the product answer to that architecture. Declare the tier before build: T0 Retrieval, T1 Suggestion, T2 Supervised action, T3 Delegated action. Spec the eval for that tier. Name who can stop it and the time-to-rollback. Bind the tier to a Tool Contract (what it may touch) and a Context Contract (what it may see, remember, and cite). Those artifacts live outside the model. The model cannot raise its own ceiling, mint a new verb, or delete its kill path. Identity, least privilege, and adaptive containment belong in the control plane; the ship gate is the product decision those controls should enforce.
This is the deepening of the first Agent Ops pillar for the moment when agents are treated as insiders with badges. Autonomy answers how much it may do. Tools answer what it may touch. Context answers what it may see. Authority answers who may revoke any of it when risk changes — preserve reads while blocking writes, require per-action approval, or isolate and stop. Steal the one-pager and PRD block at productleading.com/kit — declare the tier, contract the tools, contract the context, name who can stop it.