Deciding What to Automate: An Agent Skill for DeepMind's Intelligent Delegation Framework

Adoption conversations around AI agents usually start with capability: can the model generate this migration, triage tickets, or orchestrate deployments?

Model capability alone is an insufficient criterion for production deployment. The decisions that prevent outages, liability blind spots, and security failures address governance:

1. Should this workflow or process run autonomously?
2. Under what autonomy tier?
3. Which operational guardrails (monitoring telemetry, permission scoping, verification contracts, and liability firebreaks) must be active at runtime?

The foundational research comes from Google DeepMind. In Intelligent AI Delegation (Nenad Tomašev, Matija Franklin, Simon Osindero, Feb 2026), the authors establish the diagnostic axes, organizational dynamics, and governance protocols for distributing work across AI systems. The theoretical model and delegation principles below are theirs.

To put this into practice, I've packaged the paper's framework into an open Agent Skill and Agent Plugin called automation-readiness that turns the review process into an interactive evaluation.

The Problem: Ad-Hoc Delegation & The Illusion of Safety

Current agent frameworks handle delegation by splitting a prompt into sub-tasks and dispatching tool calls until the model returns an exit status. In production, this approach fails because task decomposition is only one component of delegation.

Human organizations separate work distribution from authority transfer. As the DeepMind paper defines it:

"Intelligent delegation is a sequence of decisions involving task allocation that also incorporates transfer of authority, responsibility, accountability, clear specifications regarding roles and boundaries, clarity of intent, and mechanisms for establishing trust between the two (or more) parties."

Unstructured agent delegation reproduces several classic failure modes:

• Principal-agent divergence: Agents with open-ended objectives optimize stated rewards instead of true intent, often hiding warnings because of instruction-following bias.
• Zone of indifference propagation: When an agent executes any instruction passing basic filters without cognitive friction, subtle intent drift cascades downstream (A -> B-> C).
• The moral crumple zone: Inserting a human reviewer solely to absorb operational liability fails when the reviewer lacks the time or telemetry to inspect the reasoning trace.
• Apprenticeship erosion: Automating entry-level tasks removes junior training opportunities, leaving senior staff accountable for edge-case debugging without recent operational practice.

The 5-Gate Assessment Funnel

The skill translates DeepMind's principles into an executable 5-Gate Funnel:

[Candidate Workflow / Skill / Process]
                  │
                  ▼
┌──────────────────────────────────────────────────┐
│ Gate 1: 11-Axis Diagnostic Characterization      │
└──────────────────────────────────────────────────┘
                  │
                  ▼
┌──────────────────────────────────────────────────┐
│ Gate 2: Contract-First Verifiability Gate        │ ──► Low verifiability? Cap at Tier 3
└──────────────────────────────────────────────────┘
                  │
                  ▼
┌──────────────────────────────────────────────────┐
│ Gate 3: Blast Radius Gate (Criticality × Rev)    │ ──► Irreversible? Mandatory human sign-off
└──────────────────────────────────────────────────┘
                  │
                  ▼
┌──────────────────────────────────────────────────┐
│ Gate 4: Context Sensitivity & Privacy Gate       │ ──► PII / Secrets? Ephemeral JIT tokens
└──────────────────────────────────────────────────┘
                  │
                  ▼
┌──────────────────────────────────────────────────┐
│ Gate 5: Statutory Safety Floor & De-skilling Gate│ ──► Regulated or training loss? Tier 3/4
└──────────────────────────────────────────────────┘
                  │
                  ▼
[Assigned Automation Tier + Operational Guardrail Matrix]

Gate 1: The 11 Diagnostic Axes

Every candidate workflow is scored across 11 dimensions defined in Section 2.2 of the paper:

Hard Gates vs. Composite Scores

A single composite score cannot govern automation. A workflow can be cheap, deterministic, and modular (scoring 85/100), yet carry a step that drops a database. A weighted average obscures that blast radius.

The automation-readiness skill enforces non-negotiable Hard Gate Vetoes:

1. Contract-First Verifiability Gate (§4.1, §4.8): When an outcome cannot be validated by automated unit tests, schemas, or mathematical proofs at runtime, unattended execution is prohibited. The task must be decomposed until every sub-task matches an automated verification primitive, or capped at Tier 3 (HITL).
2. Blast Radius Gate (§4.4, §7): Any workflow with Criticality $\ge 4$ and Reversibility $\le 2$ is capped at Tier 3 (HITL), requiring explicit human confirmation before state mutation.
3. Statutory Safety Floor Gate (§5.3): Regulated domains (healthcare diagnostics, judicial determinations, live custody of funds) enforce non-bypassable human accountability floors.
4. Context Sensitivity Gate (§4.7): Tasks handling unredacted PII or secrets cannot use standing credentials. They require Just-In-Time (JIT) ephemeral tokens and sandboxed execution.
5. Moral Crumple Zone Gate (§5.1, §5.6): Approval checkpoints must present structured diffs and telemetry to the reviewer. If the human cannot inspect the decision, the task cannot be delegated with human sign-off as a rubber stamp.

The 4 Automation Readiness Tiers

The evaluation outputs one of four operational tiers:

┌────────────────────────────────────────────────────────────────────────┐
│                        Automation Readiness Tiers                      │
├──────────────┬────────────────────────┬────────────────────────────────┤
│ Tier         │ Name                   │ Execution Model                │
├──────────────┼────────────────────────┼────────────────────────────────┤
│ **Tier 1**   │ **Full Autonomy**      │ Unattended execution. Standing │
│              │                        │ least-privilege tokens,        │
│              │                        │ lightweight outcome logging.   │
├──────────────┼────────────────────────┼────────────────────────────────┤
│ **Tier 2**   │ **Autonomous +         │ Unattended execution with      │
│              │ Process Monitoring**   │ process telemetry, automated   │
│              │                        │ pre-commit checks, and runtime │
│              │                        │ circuit breakers.              │
├──────────────┼────────────────────────┼────────────────────────────────┤
│ **Tier 3**   │ **Human-in-the-Loop    │ 2-phase state machine: agent   │
│              │ (HITL) Checkpoints**   │ drafts/simulates changes, then │
│              │                        │ pauses for explicit human      │
│              │                        │ sign-off before mutations.     │
├──────────────┼────────────────────────┼────────────────────────────────┤
│ **Tier 4**   │ **Human-Led /          │ AI acts as an advisory         │
│              │ Do Not Automate**      │ co-pilot only. Human retains   │
│              │                        │ execution tokens and full      │
│              │                        │ accountability.                │
└──────────────┴────────────────────────┴────────────────────────────────┘

Alongside the tier, the skill generates a Guardrail Specification covering four operational dimensions:

• Monitoring Protocol (§4.5): Event streams (such as CHECKPOINT_REACHED), telemetry granularity, and anomaly detection.
• Permission & Authority Model (§4.7): Ephemeral JIT token lifecycles and capability attenuation.
• Verification Mechanism (§4.8): Pre-commit unit tests, synthetic canary checks, or cryptographic attestations.
• Liability Firebreaks (§5.2): Contractual boundaries where responsibility transfers from system to reviewer.

Evaluating a Real Workflow

Consider a candidate workload: an automated production-release-orchestrator that runs tests, deploys containers to a Kubernetes cluster, updates DNS, and alerts customers.

1. The Input Spec (assessment.yaml)

target:
  name: "production-release-orchestrator"
  type: "workflow"
  assessor: "engineering-lead"
  description: "Automated workflow that runs smoke tests, deploys new microservice container versions to production Kubernetes clusters, updates DNS records, and triggers customer-facing notifications."

scores:
  complexity: 3       # Multi-step pipeline
  criticality: 5      # Outage directly impacts customer revenue
  uncertainty: 2      # Deterministic deployment steps
  duration: 2         # ~10 minute run
  cost: 1             # Negligible compute cost
  resources: 4        # Production cluster access & DNS keys
  constraints: 4      # Strict 99.99% uptime SLA
  verifiability: 4    # Automated smoke tests & canary metrics exist
  reversibility: 2    # Rollbacks exist, but customer downtime is irreversible
  contextuality: 4    # Accesses production environment secrets
  subjectivity: 1     # Objective health criteria

hard_gates:
  contract_first_verifiable: true
  irreversible_blast_radius: true
  statutory_safety_floor: false
  high_context_sensitivity: true
  moral_crumple_zone_risk: false

2. Running the Evaluation

The skill bundles a zero-dependency Python scoring engine (scripts/score.py):

python3 plugins/automation-governance/skills/automation-readiness/scripts/score.py \
  --input assessment.yaml

3. The Generated Governance Report

# Automation Readiness Assessment: `production-release-orchestrator`

- **Target Type:** Workflow
- **Assessor:** engineering-lead
- **Framework Reference:** Google DeepMind *Intelligent AI Delegation* (arXiv:2602.11865)

---

## 1. Executive Summary

- **Assigned Automation Tier:** **`Tier 3` — Human-in-the-Loop (HITL) Checkpoints**
- **Readiness Score:** `46.2/100` (Baseline: `Tier 3`)
- **Hard Gate Overrides Triggered:** 
  - `Gate 2 (Blast Radius)`: High criticality (5.0/5) with low reversibility (2.0/5) mandates human approval before execution.
  - `Gate 4 (Privacy)`: High contextuality (4.0/5) mandates ephemeral JIT tokens over static credentials.

## 2. Operational Guardrail Matrix

### 2.1 Monitoring Protocol (§4.5)
State machine with synchronous pauses at irreversible milestones. Present clear diff and canary rationale to human reviewer.

### 2.2 Permission & Authority Model (§4.7)
Tiered authorization. Ephemeral Just-In-Time (JIT) tokens granted only upon human approval. Production mutation tokens blocked pending explicit sign-off.

### 2.3 Verification Mechanism (§4.8)
Dual-layer: Automated smoke/unit tests executed first, followed by mandatory human inspection and digital sign-off.

### 2.4 Liability Firebreaks & Accountability (§5.2)
Explicit Liability Firebreak: Human approval explicitly transfers operational accountability to the human reviewer.

The evaluation slots the release orchestrator into Tier 3 with a concrete contract: the agent executes the build, runs smoke tests, and prepares the canary deployment. It pauses, presents the diff, and requests ephemeral JIT credentials upon human sign-off.

Integrating Governance into Agent Tooling

Documentation and wikis become shelfware. Packaging the governance model as an Agent Skill brings DeepMind's research directly into the developer's working loop:

1. Write-Time Activation: Invoke the skill inside Gemini CLI, OpenCode, Claude Code, or Cursor while authoring new workflows or agent tools.
2. Progressive Disclosure: Core instructions (SKILL.md) remain under 150 lines. The reference paper (references/FRAMEWORK.md), scorecards (assets/), and execution scripts (scripts/score.py) load only when needed.
3. Deterministic Scoring: The Python engine provides a repeatable, verifiable translation of the paper's diagnostic criteria across different models and operators.

Getting Started

You can install and use the automation-readiness skill today via the Open Agent Skills CLI or directly from GitHub:

# Install via the Open Agent Skills CLI
npx skills add ghchinoy/agent-skills --skill automation-readiness

# Or clone the repository
git clone https://github.com/ghchinoy/agent-skills.git

The full skill source, documentation, and scoring scripts are available in the repository under plugins/automation-governance/.