Governed delegation
Why governed autonomous LLM work
How a human can delegate meaningful work to a non-deterministic system without supervising every action or granting unrestricted authority.
Language models can already do useful software work. The harder issue is that useful work has consequences (files, commands, networks, credentials), and those consequences either wait on a human at every step, or they do not.
Supervising every consequential action preserves control and destroys delegation. Unrestricted authority preserves speed and gambles on a probabilistic system. A third option is to separate how freely the system may work from what it is allowed to reach.
Capability does not equal authority
A model becoming better at performing work does not automatically justify giving it more authority.
Capability is whether the system can produce useful changes. Authority is what effects it is permitted to cause while it tries. Conflating the two is how teams either freeze in approval loops or expand trust because the demos look good.
Making agents more effective at completing tasks is largely the domain of harness engineering: context, tools, loops, memory, planning, repository understanding. Better harnesses sharpen the delegation question: under what conditions should an increasingly effective system be allowed to work unattended? See agent harnesses.
The approval paradox
Approvals are useful controls. They fit exceptional actions, irreversible effects, and boundaries you are not willing to encode yet. Nothing here argues that human-in-the-loop systems are always wrong.
The paradox appears when approval becomes the routine execution path for every meaningful step. If the human must continuously grant permission, the system is not performing unattended delegation; the human remains in the critical path of the work itself.
That is not a moral failure of careful operators. It is a control design that cannot scale with the autonomy people want from these models.
Autonomy versus authority
Two variables are often treated as one. They are not.
Autonomy
How independently the system performs work: how far it can proceed without a human choosing the next step.
Autonomy and authority do not have to increase together. You can grant more freedom to work while narrowing what the environment can touch.
Raising autonomy without raising authority is the design space OpenTendril investigates: unattended progress inside a consequence boundary that does not expand just because the model asked.
Control consequences, not model thoughts
Prompts, policies, and evaluations influence what a model tends to say and propose. They are not the same as an environment that cannot reach forbidden effects.
Instruction
“Do not do X.”
Enforcement
“The execution environment cannot reach X.”
The first depends on the model complying. The second depends on what the runtime can access. Both can be useful; only one is a hard consequence boundary. Deeper treatment of isolation, credentials, and deployment hardness belongs on containment.
Move human control outward
If the human is not approving every step, control has to live somewhere else. Four different controls are often collapsed into one vague “human in the loop”:
| Control | Meaning |
|---|---|
| Approval | Execution waits for a human decision before a step proceeds. |
| Observation | A human can inspect what is happening, including while it runs. |
| Intervention | A human can stop or interrupt the run without having pre-approved every action. |
| Acceptance | A human decides whether output becomes authoritative project state. |
Unattended work aims to remove routine approval from the critical path while keeping observation, optional intervention, and final acceptance. See observation without becoming a permission gate and Git as acceptance.
What OpenTendril tests
OpenTendril is one experimental implementation of this design space, not a proof that the design always works. The current objective, stated as a capability a Botanist should have:
Grant an LLM full freedom inside a Terrarium, be asked for nothing while it works, keep the ability to watch, find that nothing outside the declared boundary was touched, and receive the result as Git Fruit for review, while work quality and acceptance remain a separate judgment.
OpenTendril reports containment and execution. It does not decide whether the change is worth keeping. That decision stays with the Botanist. How success and failure are measured is defined on the experiment page.