Member-reserved authority and agent auto-suspension

Two governance rules adapted from the AI Governance Policy in General-Legal/agent-operated-company (§6 member-reserved actions, §10 automatic suspension). The rules live in src/company_os/agent_oversight.rs; the schema lives in migrations/20261001020000__member_reserved_tier_and_agent_auto_suspend.sql.

"Active human owner" means an active company_agents row with role owner and no model adapter (adapter_type IS NULL), or an active ownercompany_human_memberships row. The SQL function company_has_active_human_owner(company_id) is the single definition.

Member-reserved actions

Only an active human owner may take these; an admin is refused with 403 member_reserved_owner_required and a refusal receipt.

Action	Where enforced	Receipt on refusal
Grant owner or admin (patch or create)	patch_agent, create_agent, SQL company_agent_role_set	company_agent_update_refused / company_agent_create_refused
Change an owner's role or status, or delete an owner	patch_agent, delete_agent	company_agent_update_refused / company_agent_delete_refused
Change a model-backed agent's adapter_type or model config (skill assignment is exempt)	patch_agent	company_agent_update_refused
Grant a root delegation (carve-outs from a held parent grant are unchanged)	create_delegation	delegation_grant_refused
Mint a principal token that acts as another owner	issue_principal_token	principal_token_issue_refused
Lift a malfunction flag	lift_agent_malfunction	company_agent_update_refused
Decide an approval whose request_payload.required_authority is "owner"	tool-call and native-action approval decisions	tool_call_approval_decision_refused / native_action_approval_decision_refused

Succession. While a company has no active human owner, an active human admin may install a human (adapter-less) agent as owner, by promotion or creation, and nothing else. This restores oversight without root-transport recovery.

Approval producers opt in by writing required_authority: "owner" into the approval's request_payload; any other declared value refuses (approval_authority_unknown). No producer declares it yet; it exists so future equity, debt, or litigation actions can.

Auto-suspension

A model-driven principal is suspended, fail closed, while either holds:

• oversight_vacant: the company has no active human owner.
• agent_malfunction_flagged: an unlifted row in company_agent_malfunction_flags names the agent.

Suspension is derived on every read; it is never written into agent status, and a read failure refuses. Human principals are never suspended, so an owner can always act. Every refusal is 423 Locked with code: "agent_suspended" and the reason_code above.

Seam	Check	Receipt
Worker dispatch (execute_worker_inner_for_surface_timed)	vacancy, or a flag on the acting or assigned agent	task_events.dispatch_refused
Tool calls inside a run (ToolRegistry policy compose)	live read for the run's agent; the sealed contract cannot see a mid-run suspension	task-trail tool_denied
Principal-token mutations (require_company_mutation_admission)	model-backed agent rows and agent_bindings principals	governance_events.company_mutation_refused
Signed run-capability authorize	the grant's principal	governance_events.run_capability_action_refused

Settlement of an already-authorized run-capability action stays open so its outcome is still recorded.

Operating it

GET  /api/company/companies/:company_id/agents/:agent_id/suspension
POST /api/company/companies/:company_id/agents/:agent_id/suspension        {"reason": "..."}
POST /api/company/companies/:company_id/agents/:agent_id/suspension/lift   {"reason": "..."}

• Any active human owner or admin may flag a model-backed agent; repeating the flag while one is open is idempotent. Flags cannot be raised on human rows.
• Only an owner may lift. A lifted flag is final; a new incident is a new flag.
• Flag rows are evidence: the database refuses any rewrite except the single lift, and the runtime role has no DELETE.

Restoring a company with no owner. Promote or create a human agent as owner with an admin principal (succession), or, if the company has no usable owner/admin credential at all, use the existing root-transport owner recovery on POST …/work-packages/principal-tokens.