Bounded autonomy is what makes agent-run companies runnable. The bound is a short list of actions that always ask, and a session that is built to stop.
Dials for pace, gates for consequence
Casa separates two questions that usually get blurred. How much should the agent do between check-ins? That is a dial, and founders set it low or high per department. Which actions are consequential enough to always require a human? That is a gate, and it is not adjustable from inside a session.
The always-ask list is short and concrete: spending money, publishing anything externally, shipping code, and destructive actions. Everything on it stops the session and waits, whatever the dials say.
What a stop looks like
A gate is not an error state. The session arrives at it on purpose, with the artifact done and reviewed, and presents one decision: publish or hold. The founder acts in the terminal, and the decision is appended to the ledger with everything it approved.
Because the stop happens after review, saying yes is cheap. The work has already passed its bar; the founder is deciding consequence, not quality.
Why this is the trust primitive
Every promise the rest of the stack makes leans on this one. An operating record is only worth reading if consequential actions in it were human-approved. A public company row on Terminal is only meaningful if publishing was gated. The gate is where an agent-run company earns the right to be taken seriously.
It is also why founders can leave the dials high. Casa can do a lot between check-ins precisely because the actions that could hurt always ask first.
Nothing ships without you. That sentence is the product.