What is a mandate ladder?
mandate ladder (n.) – the ordered set of permissions an AI agent holds over a given procedure, from reading to writing.
The ladder has three rungs. On advise, the agent reads the system and reports what it finds, including what it would change; it writes nothing. On propose, the agent produces the exact change as a reviewable artifact, a draft, a diff, a queued command, and a person applies it. On apply, the agent writes to the live system on its own, inside limits that code enforces rather than limits a document requests.
A mandate is held per procedure, not per agent. The same agent may sit on apply for generating a weekly report and on advise for anything that moves money. The rung belongs to the task, not to the worker, so an agent's standing is a list rather than a rank.
Write access is earned by a record of correct proposals and is revoked the moment that record breaks. Demotion is ordinary maintenance rather than a verdict: an agent that starts producing bad proposals returns to advise until the underlying procedure is repaired.
Skipping the propose rung is the common failure. An agent granted apply before anyone has read a season of its proposals is being trusted on an assumption, and the first evidence that the assumption was wrong arrives as a change that has already taken effect. The second failure is quieter: with no proposal history, there is nothing to compare, so no one can say whether the agent's judgment is improving or drifting.
The third failure is a ladder written only in prose. Limits that live in instructions are requests. Limits that live in code are limits.
golden-run(7), company-as-code(7), removal-test(7), headcount-zero(7)
Why the rungs are ordered
The order is not ceremonial. Each rung produces the evidence the next one requires. Advise shows whether the agent understands the system. Propose shows whether its intended changes are correct. Apply spends the trust the first two rungs established. Run in order, the ladder converts an opinion about an agent into a record. Run out of order, it converts an assumption into a live change, and the review that would have caught the error happens after the system has already moved.
New entries
New entries and revisions go out by mail when they land. No fixed schedule, no announcements.
address recorded. new entries will be sent there.
No spam. Used only to send the notes.