GLEMAD SAFETY · RUNTIME AUTHORITY
The Safe Autonomy Framework defines when an Ollandi control may observe, recommend, or act. Authority is explicit, scoped to an environment, revocable at runtime, and constrained by consequence, reversibility, policy, and evidence.
Capability describes what a system can do. Authority defines what it is permitted to do now.
THE THREE OLLANDI CONTROLS
No authority to change the environment
Ollandi interprets live infrastructure state, connects evidence across domains, and notifies the responsible operator. The control can explain what it sees and why the event matters, but it does not alter the environment.
An operator retains decision authority
Ollandi prepares a bounded response, shows expected consequence and rollback conditions, and routes the decision to an authorized operator. Approval, refusal, and any amended scope become part of the record.
Only pre-authorized, policy-bounded action
Ollandi may execute a response only when an institution has granted authority for the named environment, condition, and action. Runtime policy must still permit it. That authority remains visible and can be withdrawn.
THE ACTION GATE
A prior approval does not remove the runtime check. The current environment, evidence, policy, consequence, and authority state must still agree.
The proposed action falls inside an explicit rule that is active for this environment.
The conclusion remains attached to the observations that support it, including unresolved conflict.
The affected services, dependencies, blast radius, and likely operational cost are understood.
The response has a defined rollback path, or its irreversible consequence has been separately authorized.
A named institutional owner granted the scope, and that grant remains active at decision time.
Ambiguity, missing context, or conflicting evidence has not crossed the escalation threshold.
Confidence can inform review. It cannot create authority, replace policy, or justify an action on its own.
WHEN A BOUNDARY IS REACHED
Do not execute an action that falls outside any gate condition.
Keep the evidence, policy result, and authority state that caused the block.
Show the operator what is unresolved and what consequence requires a decision.
Return authority to the named human role with a bounded set of response options.
REVOCATION
An institution can narrow or withdraw an authority grant when policy changes, operating conditions deteriorate, or observed behavior departs from the approved boundary.
Revocation returns the control to a lower authority layer. The transition and its reason remain part of the evidence record.
ASSURANCE BEFORE AUTHORITY
Model evaluation and red teaming examine whether reasoning, escalation, and refusal behavior remain inside the intended authority envelope under pressure.
Read model evaluation and red teaming