A0 agents are deterministic pipelines — no language-model inference, no stochastic generation. Given the same inputs they produce identical outputs, byte-for-byte. They run against frozen golden datasets to evaluate, validate, or transform structured data through pure functions. Because they are deterministic, they are the only class that can be used inside the validation system itself without circular trust.
What it does
- ✓Executes pure, deterministic transformations over structured data.
- ✓Validates other agents against frozen golden datasets and emits pass/fail scores.
- ✓Computes metrics, checksums, and reproducible aggregations.
- ✓Runs continuously in CI and on schedule to detect drift.
What it does not
- ✗Does not invoke any language model or stochastic component.
- ✗Does not author free-form text or summaries for human consumption.
- ✗Does not write to live tables — emits results to read-only evaluation stores.
- ✗Does not require a human reviewer because its output is mechanically reproducible.
Human role required
None at runtime. Humans approve the rules and golden datasets out-of-band; the agent itself never asks for a human gate.
Example agents in this class
Regulatory rationale
Determinism is the bedrock of computer-system validation (21 CFR Part 11, GAMP 5 Category 3). Because the function from input to output is mathematically fixed, an A0 agent can be revalidated by re-running the suite — there is no inference variability to audit. This is why A0 is the only class permitted inside the evaluation harness.
A1 agents draft, suggest, retrieve, or answer questions on demand. The human is the author of record — they read the suggestion, edit freely, and own the final artifact. The agent never writes back to any system of record on its own; its output lives only inside the human user’s editor or chat window until the human chooses to act on it. Think of A1 as a smarter clipboard, a faster search, or an always-on co-author.
What it does
- ✓Drafts free-form text (minutes, summaries, narratives) for a human to revise.
- ✓Answers questions from the regulatory and protocol corpus with citations.
- ✓Suggests phrasing, structure, or candidate next steps inside an editor.
- ✓Provides retrieval-augmented context on demand to other agents and humans.
What it does not
- ✗Does not write to staging or live tables autonomously.
- ✗Does not trigger downstream workflows or notifications.
- ✗Does not assert authority over an artifact — the human edits and owns it.
- ✗Does not bypass citation grounding when answering factual questions.
Human role required
The human is the author. They read, edit, and decide whether to use any suggestion; nothing the agent emits is binding until the human commits it.
Example agents in this class
Regulatory rationale
Because the human is the sole author of record and the agent output is not persisted to any GxP system, A1 falls outside the Part 11 e-record perimeter for the suggestion itself. Citation grounding is still mandatory (architectural invariant 3) so that human-accepted phrasing is traceable to source.
A2 is the default class for regulated work in this platform. The agent produces a complete artifact — a budget, a protocol section, a coded adverse event, a CDISC mapping — and writes it to a staging table. A qualified human then opens the staged record, reviews it against the agent’s citations and provenance trail, and applies a 21 CFR Part 11 e-signature to promote it to live. Without the signature row, the staged record never reaches a system of record. This is the architectural realization of "agent proposes, human disposes."
What it does
- ✓Produces a complete, citation-grounded artifact and writes it to staging.
- ✓Attaches provenance (created_by, created_at, provenance_id) to every row.
- ✓Surfaces the diff against any prior live version for fast human comparison.
- ✓Refuses to promote its own work — the staging→live transition is signature-gated.
What it does not
- ✗Does not write directly to live tables under any circumstance.
- ✗Does not approve or e-sign its own output, or another agent’s output.
- ✗Does not pre-select a human reviewer in a way that bypasses qualification rules.
- ✗Does not retry a rejected artifact without an explicit re-tasking event.
Human role required
A qualified, role-credentialed human reviewer must re-authenticate, state intent, and apply a Part 11 e-signature to promote each staged record to live.
Example agents in this class
Regulatory rationale
A2 implements the 21 CFR Part 11 §11.10/§11.50/§11.70 controls end-to-end: agents write only to staging (invariant 1), the e-signature row is immutable and bound to the record it approves, and every promotion produces an attributable, contemporaneous, original audit entry. This is the only class permitted for sponsor-facing or regulator-facing artifacts.
A3 agents run continuously over high-volume, low-individual-risk work — classifying documents, opening queries, filing eTMF placeholders. The human role shifts from per-record reviewer to exception handler and statistical sampler. The agent’s confidence threshold and exception rules are themselves an A2 artifact: they had to be signed off before the agent could begin running. Humans review every exception, audit a documented sample of routine outputs, and sign off on changes to the rules.
What it does
- ✓Continuously processes routine, high-volume work without per-item review.
- ✓Routes low-confidence, ambiguous, or rule-violating items to a human queue as exceptions.
- ✓Emits a documented, auditable sample of routine decisions for periodic human review.
- ✓Runs only against thresholds and rules that were themselves promoted via A2.
What it does not
- ✗Does not handle items its rules mark as out-of-scope or low-confidence — those escalate.
- ✗Does not change its own thresholds or exception rules without an A2 sign-off cycle.
- ✗Does not skip the sampling audit — sample coverage is a CI-checked metric.
- ✗Does not perform safety, causality, or sponsor-facing authoring work.
Human role required
Humans review 100% of exceptions plus a documented sample of routine outputs; an A2-signed rule set governs everything the agent does on its own.
Example agents in this class
Regulatory rationale
A3 is justifiable under risk-based GxP only when (a) each individual decision is low-stakes, (b) the rules and thresholds are themselves under change control, and (c) sampling produces statistically defensible coverage. The exception queue is the safety valve; the A2-signed rules are the control. Without both, the agent must drop to A2.
PROHIBITED — Architectural impossibility
A4 cannot be constructed, staged, promoted, or configured on this platform. Rejection is enforced in packages/policy/ and is part of the architectural invariant set; no environment flag changes this.
A4 — fully autonomous agent action with no human in the loop — is prohibited on this platform. The prohibition is not a policy that can be configured away; it is enforced in code in packages/policy/, which refuses to construct or promote any record carrying an A4 class. The model registry has no A4-eligible defaults. There is no UI affordance to assign an agent to A4. Any attempt to introduce one is rejected by the security-review gate. The prohibition exists because every regulated action on this platform must be attributable to a signed human, and A4 by definition cannot satisfy that.
What it does
- ✓Nothing. A4 has no production code path.
- ✓Appears in the AutonomyClassValue union strictly to make rejection explicit.
- ✓Triggers a hard PolicyError if it ever reaches the orchestrator.
- ✓Is referenced only in tests that prove the rejection is in force.
What it does not
- ✗Does not write to staging — construction is rejected before staging is reached.
- ✗Does not write to live — the e-signature gate has no codepath that accepts A4.
- ✗Does not exist as a runtime configuration option in any environment.
- ✗Does not appear in any model-registry default for any agent.
Human role required
N/A — A4 is structurally impossible. Every regulated change must be attributable to a signed human; an unattributable change is rejected at the boundary.
Example agents in this class
No agents — this class is prohibited.
Regulatory rationale
21 CFR Part 11, ICH E6(R3) §2.13, and EMA Reflection Paper on AI all converge on the same requirement: a qualified human must be accountable for every regulated decision. A4 by definition removes that accountability and is therefore incompatible with the regulatory frame this platform operates in. Invariant 4 in CLAUDE.md states this explicitly: A4 is prohibited.