Autonomy is an architecture, not a feature you switch on

A scheduler runs jobs at a time. An orchestrator decides what should run, in what order, given what has actually changed. The system builds each run plan from the state of the estate: what arrived, what drifted, what failed last time and still needs reprocessing, and what downstream models depend on it. Dependencies come from lineage rather than from a hand-maintained graph, so adding a source does not depend on someone remembering to update the schedule.

• Run plans derived from source state and lineage rather than from a fixed calendar.
• Backfill, retry and partial reprocessing are normal operations, not incidents.
• Concurrency and resource limits are enforced per source, so one estate event cannot starve the rest.
• Every plan is stored with the inputs that produced it, so any run can be explained afterwards.

The system proposes mappings and repairs, scores each proposal on the evidence behind it, and records what happened when a reviewer accepted or rejected it. Those outcomes move the confidence thresholds for that source and that class of change. The adaptation is deliberately narrow: it changes how certain the system must be before it acts, never what it is permitted to do. The set of permitted actions is fixed in the design and changes only when a person changes it.

• Mapping proposals scored on structural, statistical and semantic evidence, field by field.
• Review outcomes fed back as labelled examples for that estate, never pooled across clients.
• Thresholds move inside bounds agreed at design time; the action space itself stays fixed.
• Nothing is learned from data the system was not explicitly granted for that purpose.

Validation runs on the full population, before publication, and it is the only thing that can promote a run. Assertions cover structure, referential integrity, business rules and distribution. Reconciliation compares against source, or against the outgoing platform where one still exists. The gate returns one of four outcomes, and no confidence score can override it: publish, publish in part, hold, or roll back.

• Full-population checks rather than sampling, with thresholds set per rule.
• Reconciliation against source or legacy platform, with differences explained rather than counted.
• Distribution drift measured against an agreed baseline, not merely against the previous run.
• A run that fails its own checks cannot be published by the system under any circumstances.

Autonomy without an escalation path is just an unattended failure. Every system we build names in advance the decisions it is not permitted to take: rules with material financial impact, ambiguous entity matches above an agreed threshold, structural changes to the target model, anything touching classified fields. Those arrive in a review queue carrying the evidence, the proposed action and the consequence of each option. The queue is part of the system, not an inbox beside it.

• An escalation policy written and agreed before the build rather than discovered in production.
• Each item carries its evidence, the proposed action and the effect of accepting or rejecting it.
• Decisions are attributable and timestamped, and become part of the permanent audit trail.
• Authority can be delegated per source as confidence is established, and withdrawn the same way.