How to trust a system that acts.
At six in the evening, an agent is about to call a worker whose certification expires in nine days. It knows the renewal steps, the worker’s language, and the shift schedule that makes tomorrow a bad day to be benched. Should it be allowed to place the call? To promise the shift is safe? To book the renewal appointment and spend the money?
Software never had to answer questions like this. A system of record acts on nothing, so trust meant uptime and access control. A system that does the work needs a different architecture, and I want to describe ours precisely, because trust is where agentic platforms will be separated from agentic demos. The bar is high for a measured reason: research published in Risk Analysis found people accept an autonomous system only at four to five times the reliability they demand of a human doing the same job. Machines pay a trust premium. The architecture below is how a system pays it down, on a record instead of a promise.
The foundation is a single rule: every action is a task.
Whether a human asked for it, a schedule fired it, a trigger caught an event, or another agent handed it off, every unit of work in the system is a task in one store, with a type, an owner resolved at creation, and a full lifecycle from pending to done. Because the system’s own analyses and proposals are tasks like any other, every action traces to its origin. Nothing the system does is invisible. Auditability is not a report we generate; it is how the system is built.
On that foundation, autonomy is tiered by consequence. Reversible internal work runs free: drafting, analyzing, organizing, preparing. External and consequential actions require approval: the message a candidate receives, the spend, the commitment. And a small set of decisions is reserved for humans permanently, by design. Hiring is a regulated, high-stakes domain. We treat human oversight as a feature of the architecture, with the audit trail to prove it, because in our industry an operator who cannot demonstrate control has a compliance problem, whatever their software vendor claims. Governed automation outperforms manual compliance on the evidence: at UPS, I-9 completion by day one went from about 50 percent with the prior vendor to 98 percent on Fountain, with every completion traceable.
The part I believe is genuinely different: autonomy is earned, per action type, visibly. No agent in our system starts with the right to act unsupervised, including the interface itself. When an agent’s proposals for a given action type are approved again and again, its autonomy for that action type widens, and the customer watches it widen. Trust accrues on a record instead of being asserted in a settings page. Every operator already runs this pattern with a new hire: watch closely, then delegate what has been demonstrated.
There is a harder evaluation problem underneath, and I would rather name it than have it discovered. A system that proposes what to automate must be held to a higher standard than a system that executes a specification, because it is making the judgment a human used to make. We evaluate generated agents as a discipline of its own: whether the choice was right, whether the exceptions in the data are respected, before any generated agent runs unsupervised.
The numbers keep this honest. Roughly three quarters of reviewed agent threads achieve their goal across our agent base today. The tiering exists because of the other quarter. As that figure climbs, autonomy widens, and the two are connected by construction rather than by optimism.
Trust is half of what a CFO signs. The other half is the bill, and agentic software has mostly been embarrassing on that subject. The next article is about what this software should cost.
Next in the series: Price the Work.