What makes a ladder a control system?
A control system has a state, a rule for changing state, an observation that triggers the change, and a way to return. An autonomy ladder read as a spectrum has only the first. Read as a control system, each rung on the ftes.ai ladder specifies what the role may do without asking, what evidence justifies granting it, and what observation sends the class back down. The difference is practical: a spectrum invites a judgement call, while a control invites a reading of the record.
This framing is also what makes the ladder auditable. A reviewer can ask which rung a class sits on, what evidence was recorded when it moved, and whether the way down was ever exercised.
The unit of autonomy is the task class
A task class is a group of items a role handles the same way: exact matches under a threshold, replies to a known question type, listing corrections of one kind. Autonomy is granted to a class, not to the role, because the evidence that a role handles one class well says nothing about another. A Finance Controller Digital FTE may be excellent at exact bank-to-ledger matches and unready for partial matches, and a ladder that moved the whole role would grant both on the strength of one.
Defining the classes is therefore prior work, and a role whose classes are not written down cannot be promoted safely at all.
What does each rung actually gate?
The lowest rung gates action entirely: the role proposes and nothing happens until a human approves each item. The middle rungs gate scope: the role may act alone within written bounds — under a threshold, within a template, on a named list — and everything outside those bounds still comes for approval. The highest rungs gate only exceptions: the role acts, and the human reads the record, intervening on the items the role flags or the review surfaces. At every rung the audit trail is identical.
Nothing on the ladder gates logging, and that is deliberate. Autonomy changes who approves an item, never whether the item is recorded.
What evidence buys a rung?
A full cycle of decisions on that class, an approval rate the manager considers clean for that class with enough volume to mean something, and — the term that matters most — send-back reasons that have been about tone or preference rather than about facts, rules, or judgement for several consecutive weeks. A class can carry a high approval rate while every send-back is a substantive correction, and each of those corrections would have become an error at the next rung.
Reading reasons rather than rates is the single discipline that separates a ladder used as a control from a ladder used as a reward.
Every rung needs a defined way down
A promotion recorded without its reversal condition is a one-way delegation. On ftes.ai the step-back is written into the review note at the moment of promotion: what observation triggers it, how quickly it happens, and who is told. The usual trigger is a single substantive send-back on the promoted class, and the usual response is same-day return to the previous rung. Making the reversal cheap and pre-agreed is what makes promotion safe enough to do routinely.
A ladder where the way down has never been exercised in a year is either a very stable set of classes or a control nobody is actually operating.
Why is exclusion part of the design?
Some classes never climb. Anything on an always-escalate list, anything irreversible in the world, and anything a regulator or a contract requires a named human to decide sits outside the ladder entirely rather than at its bottom rung. Keeping them outside rather than at the bottom is a small distinction with a real effect: a class at the bottom of a ladder invites the question of when it will be promoted, and a class outside the ladder does not.
Writing the exclusion list before the first promotion is easier than writing it afterwards, when a clean record is arguing the other way.
What the ladder does not solve
It does not decide whether the work is correct, only who checks it. A role producing confidently wrong work with a compliant manager will climb the ladder, because the ladder reads approvals and approvals were given. The defences against that are elsewhere: the fact gate that refuses unsupported claims, the evidence attached to each item so a review is a real review, and the monthly reading of send-back reasons rather than rates.
The ladder is one control among several, and it works only when the approvals feeding it are genuine.