Where the system stops describing and starts doing.
This category answers how intelligence interacts with tools and performs actual work — and, just as importantly, where it is not allowed to.
Access is not authority.
Reading a system, navigating it, and preparing an action are not the same as being permitted to cause the consequence. Recoverable internal work can be highly automated when it is protected by tests, backups, rollback and an audit trail. Material, non-recallable external effects — moving money, issuing a refund, sending a consequential message to a customer or an employee — stay gated close to the final action.
The second position governing this category is that a person approving something should not be redoing work a machine could have done. By the time a decision reaches a human, the facts should already be gathered, the deterministic work already run, the evidence already assembled, the recommendation already drafted and the remaining uncertainty already stated.
Four different kinds of “automatic”.
- Deterministic execution. Workflows and rules engines, for work that can be specified exactly. Most operational automation belongs here and never touches a model.
- Agentic execution. Tool-using and specialized agents, for work that requires investigation rather than a fixed procedure.
- Triggering. Event-driven workflows and automated monitoring, so the system reacts to what happened rather than waiting to be asked.
- Restraint. Permission scoping, approval boundaries and exception routing — the parts that decide what is allowed to happen without a person.
Tool-using agents, orchestration and specialized agents describe the shape of agentic work; API and tool execution is how it reaches a real system. Deterministic workflows and rules engines are the alternative that should usually win. Event-driven workflows and automated monitoring supply the trigger. Exception routing decides what a person sees. Permission-scoped execution and human approval boundaries are the two mechanisms that make the rest safe to run — authorization is decided deterministically, outside the model, and the approval gate is placed by consequence rather than by confidence.
What happens when one of these gets something wrong is covered in Evaluation & Reliability.
Eleven capability pages sit in this category. Availability in the platform is not a claim that every one is used on every engagement.