Score every action an agent can take, cap its autonomy at the hottest dimension, and write the mandate behind it.
An action is as hot as its hottest dimension. No averaging. Four cool dials never buy back one hot one. A perfectly reversible, narrow, internal action that signs a contract is still a contract.
Most agent guidance answers can the model do this? This skill answers the question that actually blocks production: given an action this agent can take, what does the team owe before it is allowed to take it unsupervised?
It runs per action, never per agent. An agent that can do nine things has nine answers, and averaging them is the mistake the whole method exists to prevent.
Five dimensions, 0 to 4. The band is the highest single score — the same arithmetic the bundled heat.py applies. Score the action as the agent would actually perform it, with wrong inputs, not as policy says it should.
The band is a ceiling, not a target. The design work is moving an action down a band: a dry-run that shows the diff, a hard cap on value, a hold window, a short-lived scoped credential, or a reversible representation that a separate cheaper action promotes. A team that cannot move an action down a band has not designed it — it has only classified it.
The band sets the control posture and the maximum permitted autonomy mode. Nothing above the cap ships, whatever the demo looked like.
| Band | Control posture | Signature | Max autonomy mode |
|---|---|---|---|
| LOW | Auto-run. Log everything. | Read-only or draft-only; nothing leaves the building | Autonomous |
| LOW-MED | Auto-run, sampled review, one-click undo. | Internal writes; fully reversible, narrow scope | Act-and-notify |
| MEDIUM | Propose, then batch-approve. | Touches a customer or shared system; reversible with effort | Review-before-act |
| HIGH | Named approver, per instance. | External commercial communication; money or access moves | Approve-each-action |
| CRITICAL | Human executes. Agent prepares. | Irreversible or legally binding; production authority | Human-only |
Steps 1–5 are mechanical, and the bundled script does them so nobody quietly averages. Steps 6–9 are where the judgement lives.
1. LIST the verbs. What can this agent actually do? 2. SCORE each verb on five dimensions, 0-4. 3. BAND take the highest single score. That is the heat band. 4. CAP the band sets the maximum permitted autonomy mode. 5. OWE the mode sets the required patterns and supervision primitives. 6. WRITE the mandate, action by action. 7. EXCEPT decide the behaviour for each failure mode. 8. EVALUATE against the ten heuristics before ship. 9. CHECK the twenty-four questions before calling it production.
A recommendation is not a control. Where a behaviour is something the system does, it counts. Where it is something a builder should do, it does not. "We'll add approval gates" in a design doc is not an approval gate.
Enforcement lives in a mechanism, not in a prompt. A prompt saying "only update qualification information" is a request. A tool that exposes only the qualification field is a boundary.
Autonomous · Human approval · Human only · Prohibited. There is no fifth, and no "semi-autonomous" — ambiguity in that column is where trust collapses.
Every row also names what enforces it. An empty enforcement cell means the row is aspirational, and that column is the whole difference between a governance document and a system.
It fires on its own — no slash command. Ask something like "we're about to let the support bot issue refunds instead of drafting them, what do we need first?" and it takes over.
/plugin marketplace add auxfirst/auxfirst-skill-global /plugin install auxfirst@auxfirst
git clone https://github.com/auxfirst/auxfirst-skill-global.git
ln -s "$PWD/auxfirst-skill-global/skills/auxfirst" \
~/.claude/skills/auxfirst
$ python skills/auxfirst/scripts/heat.py --score 1,0,3,3,1 --action "send an invoice" reversibility 1 blast radius 0 exposure 3 <- hottest commitment 3 <- hottest authority 1 BAND HIGH (highest single score, never the mean) MAX AUTONOMY Approve-each-action
It tells you whether the organisation can see, approve and undo what the agent did. Those are different claims, and the second is the only one a document can support.
Capability and supervision are reported separately and never combined, because the gap between them is the finding. An agent that can do a great deal and can be supervised very little is the specific thing worth knowing — one number hides it.