---
title: "Governed autonomy, and how to stop it"
description: "Autonomy is set lane by lane, new behavior runs in shadow first, and you can brake one lane or the whole fleet."
url: "https://docs.octo.ad/why/governed-autonomy/"
id: "why/governed-autonomy"
type: "concept"
audience: "admin"
dateModified: "2026-11-06"
productArea: "agents at work"
keywords: ["governed autonomy", "kill switch"]
---

# Governed autonomy, and how to stop it

> Autonomy is set lane by lane, new behavior runs in shadow first, and you can brake one lane or the whole fleet.

## What governed autonomy means

Autonomy is set per lane, not for the whole system. Each lane has a scope: which systems it may touch, what it may change, which moves need a person. New behavior runs in shadow first, with a date by which someone keeps it or kills it. Consequential actions pass a coherence check first. You can brake one lane or the whole fleet.

## Switching it off

You name who may switch it off; on the first steps that is the decision owner and IT. Autonomy is set per lane, and new automation runs in shadow first: it records what it would have done and does nothing outside, with a decision date and a kill switch. You can brake one lane or the whole fleet. Every approval is logged, so you can see what it did.

## Autonomy control, by category

- **What the category typically offers:** Frameworks offer a human-in-the-loop hook; automation is on or off per flow.
- **What OCTOPUS does:** Autonomy is set per lane. New behavior runs in shadow first, with a decision date and a kill switch. Brake the whole fleet or one lane.
- **Question to ask any vendor:** Show the autonomy setting for one lane and the kill switch for one new behavior.