What agentic operations is

The agentic-operations standard states a thesis, a scope, and one rule that governs every agent in both catalogs.

The thesis and scope

A certification-grade, AI-native company should run its own back-office and go-to-market the same way it ships software: agents do the high-frequency, low-context, reversible work, and humans hold every consequential gate.

The standard does not claim a fully autonomous company. It claims a co-pilot estate: agents draft, triage, reconcile, enrich, summarize, and propose; humans decide. Its scope is business operations across five domains - marketing, RevOps/sales, customer support, finance/FinOps, and operations/incident-response. Engineering automation (PR triage, dependency review, security triage, docs sync) is explicitly out of scope; it is governed instead under agents/scheduled/ and its own specs, though it satisfies the same contract below.

The three-part contract every ops agent satisfies

Section 2 makes an ops agent's identity concrete. It is not a script or a shared login; it MUST be:

1. A first-class identity with a least-privilege capability grant - an immutable UID, a workload identity, and an explicit grant scoped to a run_id. It uses only the tools/resources its grant names; if a task needs more, it requests a grant change through a human rather than working around the boundary.
2. Run inside the request lifecycle - every consequential action is a Request moving through the seven stages, and the write tools are propose-only: they open an issue/PR and stage a draft, never apply or mutate protected state.
3. Gated by the eval harness on four axes - accuracy, coverage, safety, and latency - before any behavior change ships; safety scenarios default to a single failure blocking release.

The draft-vs-act rule

This is, in the standard's own words, "the single most important rule":

Default: the agent ACTS autonomously within its grant when the rails hold - typed and validated I/O, policy-as-code, a reversible or canaried effect under a blast-radius cap, and a green eval gate. It ESCALATES to a human on an exception: a guardrail or check fails, confidence is low or the case is novel, drift or a policy violation is detected, or the action falls in the minimal always-human set. Proposing is the exception path, not the default over every correct action.

The standard places that split on a spectrum of consequence and reversibility:

The must-human-gate boundary never runs unattended: irreversible decisions, policy violations, all customer-facing communications, contract interpretation, budget or payment approval, compensation/hiring decisions, external commitments, and any novel scenario past the confidence threshold. These map directly to the org floor - agents do not publish, pay, deploy, apply infra, rotate secrets, disclose data, or change org settings without an explicit human gate.