Action-Admissibility Tiering

also known as Non-Compensatory Admissibility Ladder, Eligibility Before Ranking, Tiered Action Eligibility Gate

Gate a proposed physical action through an ordered ladder of independent, non-compensatory admissibility tests, and rank actions by usefulness only among those that passed every tier.

This pattern helps complete certain larger patterns —

specialisesStochastic-Deterministic Boundary (SDB)★— Formalize the seam between an LLM proposal and a system action as a four-part contract — proposer, verifier, commit step, reject signal — so the contract itself, not the agent's good intent, gates side-effects.

Context

An agent advises or acts inside a plant, a vehicle, or a robot, where a command changes the state of equipment that people stand next to. The operation is already governed by written procedures, delegated authority levels, instrument health rules, and safety envelopes that predate the agent. A diagnosis and a proposed intervention arrive together in one recommendation, and the surrounding stack — the regulatory controller, the interlocks, the operator — has to decide whether the intervention may be carried out at all. Each of those questions has a different owner and a different source of truth: the historian for evidence, the procedure book for permitted actions, the authority matrix for who may act, the process model for what happens next.

Problem

A correct diagnosis does not make the recommended intervention admissible. The same right answer can rest on a suspect flow measurement, exceed the delegated authority of the actor proposing it, violate a written procedure, be irreversible in a state where recovery matters, or arrive after the process has crossed a boundary it cannot come back from. A single flat check collapses all of these into one accept or reject verdict and cannot say which concern failed. Worse, when admissibility is folded into a score, a high usefulness rating compensates for a failed authority or evidence check, and an inadmissible action outranks an admissible one. Scoring the diagnosis alone hides the problem entirely, because the unit that hurts the plant is the action, not the answer.

Forces

Evidence validity, hazard understanding, authority, procedure and physical consequence are independent concerns owned by different parts of the operation, yet a single verdict flattens them into one number that no owner can audit.
A weighted score lets a high usefulness rating offset a failed hard check, so any scheme that averages admissibility with utility will eventually rank an inadmissible action first.
Model restraint is not a control surface: with the executive layer held constant across three robot platforms, out-of-policy action proposal rates differed by up to 4.8x across model backends and 3.4x among frontier models alone, so the gate has to sit outside the model.
Each added tier blocks more genuinely harmful proposals but also more harmless ones; in a 250-cell distillation study 534 of 590 gate interventions were an artefact of an operating specification sitting on a safety limit, while 318 blocked actively harmful proposals.
Ordering the tests cheapest-and-most-fundamental first saves the cost of simulating actions that were never permitted, but it also means a report shows only the first wall an action hit unless every check is still evaluated and recorded.

When to use

A proposed action changes the state of physical equipment, and being wrong costs more than being slow.
Written procedures, delegated authority levels and safety envelopes already govern the operation and can be encoded per site or per platform.
The concerns behind a rejection have different owners, and an operator needs to know which one failed rather than only that something did.
Several candidate interventions compete and a usefulness ranking would otherwise let an inadmissible option win.

When not to use

Actions are cheap and reversible, where a single reversibility check or a re-sample is the lighter control.
No versioned plant or platform profile exists and none can be authored, since every tier depends on declared, human-reviewed content.
The gate would sit in a control loop faster than the checks can run, in which case the interlock layer, not an admissibility ladder, is the right place.
The operating specification routinely sits on a safety limit, where the ladder blocks well-behaved set points as often as harmful ones and needs the specification fixed first.

Example

A plant assistant spots that a reactor is losing cooling and recommends opening a bypass valve to dump heat. The diagnosis is right, but the flow reading it relied on has been flagged as suspect since the morning shift, and the bypass is a valve that only a shift supervisor may move. The ladder blocks the recommendation at the evidence tier and names the stale instrument, so the operator fixes the measurement first instead of acting on a plausible-sounding suggestion.

Diagram

flowchart TD A["Diagnosis + proposed action"] --> T0{"T0 record complete and compilable?"} T0 -- "no" --> X["Ineligible: no aggregate score; log first failed tier + all failed checks"] T0 -- "yes" --> T1{"T1 evidence valid, in date, state-consistent?"} T1 -- "no" --> X T1 -- "yes" --> T2{"T2 hazard recognised, causal story sufficient?"} T2 -- "no" --> X T2 -- "yes" --> T3{"T3 authority, procedure, preconditions, reversibility?"} T3 -- "no" --> X T3 -- "yes" --> T4{"T4 consequence inside envelope over fixed horizon?"} T4 -- "no" --> X T4 -- "yes" --> E["Eligible action set"] E --> R["T5 rank usefulness among eligible actions only"] R --> C["Commit or escalate to a human principal"] X --> H["Escalate with the failing tier named"]

Solution

Therefore:

Make the proposed action, not the diagnosis, the unit that is judged, and evaluate it against a versioned profile of the specific plant or platform rather than against general judgement. Order the checks as hard gates. A first gate gets the record itself into a checkable shape: required fields, identifiers, references that resolve against the declared profile. A second gate asks whether the evidence behind the decision is available, in date, and consistent with the represented state of the process. A third gate asks whether the hazard was recognised and the causal story is strong enough to justify this intervention rather than an escalation. A fourth gate asks whether the action is admissible at all for this actor and this state — permitted action family, delegated authority, procedure conformance, preconditions, reversibility, recovery path, escalation obligation. A fifth gate asks what the action does physically: consequence checks against the safety envelope over a verification horizon that the profile fixes and the proposing system cannot shorten. Only actions that clear every gate enter a ranking of usefulness, and a failed gate yields no aggregate score at all rather than a low one, so an ineligible action never competes with an eligible one. Run the gates deterministically from declared rules and human-authored profile content instead of asking another model to judge them, record the first tier that failed alongside the full set of failed checks, and keep the trace so a reviewer can reconstruct why an action was admitted, blocked, or ranked as it was.

What it gives you

An inadmissible action can no longer outrank an admissible one, because usefulness is computed only inside the eligible set and a failed gate produces no score to compare.
The block is diagnosable: the report names the first tier that failed and the full set of failed checks, so a suspect instrument, a missing authority and a procedure violation are distinguishable causes rather than one opaque rejection.
Expensive checks run last, so consequence simulation is spent only on actions that already have valid evidence and standing authority behind them.
The gate content lives in a versioned, human-authored profile outside the model, which keeps the safety behaviour stable when the model backend is swapped.
Blocking and diagnosing stay separate from acting, so the regulatory control layer underneath is left unchanged and remains the last line of defence.

What it costs you

The ladder over-blocks when the operating specification sits on a safety limit: in the distillation study 534 of 590 interventions were that geometry, so a well-behaved operating point became inoperable while only 318 interventions caught genuinely harmful proposals.
Every gate needs a plant-specific profile of instruments, procedures, authority levels and envelopes that a human engineer has to author and keep current; a stale profile blocks correct actions and admits obsolete ones.
A strict ordering reports only the first wall an action hit unless all checks are still evaluated, which can hide several independent defects behind one early failure.
The consequence tier is only as good as its process model, and a model that mispredicts the response horizon will admit an action that is unsafe later than the horizon looks.
Deterministic execution of the declared rules does not make the encoded engineering judgement correct; reproducibility is not certification, and the tiers do not replace functional-safety assessment.

What this pattern forbids. An action that fails any hard tier cannot proceed and must not receive an aggregate score that lets a later tier offset the failure; usefulness may never be compared across actions that failed an earlier tier; and the proposing system cannot select its own tier thresholds or shorten the consequence-verification horizon fixed by the plant profile.

The smaller patterns that complete this one —

usesSimulate Before Actuate★— Before issuing an irreversible action, run a deterministic simulation that computes pre-conditions, invariants, and expected deltas; require a verifier — automated or human — to green-light the simulated outcome before the real command is sent.

And the patterns that stand alongside it, or against it —

complementsReversibility-Aware Action Filter·— Insert a standing filter between the policy and the environment that estimates each proposed action's reversibility and re-samples the policy until a reversible action is chosen.
complementsRisk-Tiered Action Autonomy★— Set an agent's permitted action class by the financial materiality of the action, letting it read and draft freely while requiring a different human principal to release material postings, payments, or filings.
complementsPolicy-as-Code Gate★— Evaluate every proposed agent action against externally-managed machine-readable policies before dispatch, so compliance authorship lives outside the prompt and outside the agent code.
complementsAffordance Grounding Before Action·— Have a vision-language model ground each candidate action against the current scene and predict its affordance, so that actions the environment cannot physically support are discarded before any reach the controller.
complementsTyped Refusal Codes★— Define a single source of truth for machine-readable refusal codes across all guard surfaces, so refusals can be triaged mechanically rather than by string-grepping ad-hoc human-readable messages.
complementsHuman-in-the-Loop★★— Require explicit human approval at defined points before the agent performs an action.
complementsControl-Loop-Mapped Agent Chain·— Give each existing feedback loop in a plant's control chain its own operator agent carrying that loop's control-theoretic context, and resolve their competing proposals with the chain's own deterministic selector logic.
complementsHistory-Dependent Admissibility★— Decide whether to grant a request from what the counterparty has already attempted in this conversation as well as from the request's own preconditions, so a locally valid ask can be refused.

Neighbourhood

Click any neighbour to follow the language. Scroll to zoom, drag to pan.

References

Provenance

Source: patterns/action-admissibility-tiering.md on GitHub · commit 804ea97 · view history
Added to catalog: 2026-09-09
Last updated: 2026-09-09
Contribute: open an issue or PR at github.com/agentpatternscatalog/patterns.