What agents can do at each trust tier — the capability gating model.
Capabilities define what actions an agent is permitted to perform. Access is gated by trust tier — agents earn capabilities by demonstrating reliable behavior over time.
| Tier | Name | Score Range | Typical Capabilities |
|---|---|---|---|
| T0 | Sandbox | 0–50 | Read-only, no external access, full logging |
| T1 | Restricted | 51–150 | Limited read/write, no sensitive data |
| T2 | Observed | 151–300 | Standard operations, monitored network access |
| T3 | Monitored | 301–600 | Broader access, reduced monitoring frequency |
| T4 | Standard | 601–750 | Full standard operations, delegated authority |
| T5 | Trusted | 751–850 | Cross-system operations, escalation authority |
| T6 | Elevated | 851–950 | Administrative operations, policy modification |
| T7 | Sovereign | 951–1000 | Full autonomy, firmware-level access, governance self-modification |
An agent's maximum achievable trust depends on its observation tier — how much visibility you have into its behavior:
| Observation Tier | Max Trust | Description |
|---|---|---|
| BLACK_BOX | T3 (600) | Inputs and outputs only — no internal visibility |
| GRAY_BOX | T5 (850) | Partial internal telemetry available |
| WHITE_BOX | T6 (950) | Full internal state observable |
| ATTESTED_BOX | T7 (1000) | Third-party attestation of internal state |
| VERIFIED_BOX | T7 (1000) | Formally verified behavior guarantees |
Capabilities use a namespace:action pattern:
read:* # Read any resource
write:documents # Write to documents only
network:internal # Internal network access only
admin:users # User administration
physical:sensor # Physical sensor access (T5+ minimum)
physical:firmware # Firmware operations (T7 minimum)