Autonomy Is a Property of the Operation: A Framework for Deciding What DevOps Agents May Do Unattended

Automation moved the execution of operational work off engineers but not their attention: someone still has to look, judge and approve, and that person has become the bottleneck. As agents built on large language models widen what a DevOps system can do, deciding what an agent may do without a human looking is now a practical configuration question. We argue that autonomy is better treated as a property of the operation than of the agent. An operation qualifies for unattended execution when it is verifiable (its result can be checked mechanically), reversible (there is a known, cheap path back) and contained (its worst case is known in advance and small). We ground the argument in closed-loop systems operators already trust, such as health-check ejection, circuit breakers and Kubernetes controllers. We then describe how the framework is implemented in a working system: a gate that scores each proposed operation from infrastructure facts against a ceiling set by one human-controlled dial, and a separate containment layer whose only output is a pull request. We report no empirical results. We separate implemented mechanisms from hypotheses and identify verifiability, which our own gate does not yet score, as the framework's main open problem.