Human Oversight and Authority Levels

Automation runs the loops; humans hold ultimate authority. Roles, permissions, and the actions reserved for people are defined explicitly, not left implicit.

Who can do what

Kronos automates control but does not remove human authority. The architecture defines authority levels — observer, operator, shift supervisor, safety authority — and binds specific actions to specific levels. High-consequence actions (relaxing a limit, bypassing an interlock, authorizing a non-standard operating point) require a level of authority and, for the highest-consequence ones, a second person.

Note the one action available to everyone regardless of level: abort. Anyone who sees something wrong can trip the machine to safe state. Authority levels gate actions that increase risk; they never gate the action that reduces it. This asymmetry is deliberate and mirrors the reflex tier's rule that anything can request safety but only authority can request more risk.

def authorized(action, level, second_person=False):
    REQUIRED = {'abort':0, 'command':1, 'relax_soft_limit':2,
                'bypass_interlock':3}
    need = REQUIRED[action]
    ok = level >= need
    if action == 'bypass_interlock':
        ok = ok and second_person       # two-person rule
    return ok

The copilots deliberately hold no authority level of their own. They can surface a recommendation, pre-fill a request, and explain their reasoning, but a human at the required level must authorize anything that crosses an envelope, and the human — not the model — owns the logged decision. This keeps accountability with people and keeps the AI in an advisory role, which is the same principle the reflex tier applies in hardware: intelligence proposes, and only humans or hardwired logic dispose of higher risk.

Every authorized high-consequence action is logged with who, when, why, and the machine state at the time — the audit trail that a safety case is built on. The AI copilots advise and can request actions, but they hold no authority level; a human authorizes anything the copilots propose that crosses an envelope. See operator abort and manual trip and interlock bypass governance.