# Member-reserved authority and agent auto-suspension

Two governance rules adapted from the AI Governance Policy in
[General-Legal/agent-operated-company](https://github.com/General-Legal/agent-operated-company)
(§6 member-reserved actions, §10 automatic suspension). The rules live in
`src/company_os/agent_oversight.rs`; the schema lives in
`migrations/20261001020000__member_reserved_tier_and_agent_auto_suspend.sql`.

"Active human owner" means an active `company_agents` row with role `owner` and
no model adapter (`adapter_type IS NULL`), or an active `owner`
`company_human_memberships` row. The SQL function
`company_has_active_human_owner(company_id)` is the single definition.

## Member-reserved actions

Only an active human owner may take these; an admin is refused with
`403 member_reserved_owner_required` and a refusal receipt.

| Action | Where enforced | Receipt on refusal |
| --- | --- | --- |
| Grant owner or admin (patch or create) | `patch_agent`, `create_agent`, SQL `company_agent_role_set` | `company_agent_update_refused` / `company_agent_create_refused` |
| Change an owner's role or status, or delete an owner | `patch_agent`, `delete_agent` | `company_agent_update_refused` / `company_agent_delete_refused` |
| Change a model-backed agent's `adapter_type` or model config (skill assignment is exempt) | `patch_agent` | `company_agent_update_refused` |
| Grant a root delegation (carve-outs from a held parent grant are unchanged) | `create_delegation` | `delegation_grant_refused` |
| Mint a principal token that acts as another owner | `issue_principal_token` | `principal_token_issue_refused` |
| Lift a malfunction flag | `lift_agent_malfunction` | `company_agent_update_refused` |
| Decide an approval whose `request_payload.required_authority` is `"owner"` | tool-call and native-action approval decisions | `tool_call_approval_decision_refused` / `native_action_approval_decision_refused` |

**Succession.** While a company has no active human owner, an active human
admin may install a human (adapter-less) agent as owner, by promotion or
creation, and nothing else. This restores oversight without root-transport
recovery.

Approval producers opt in by writing `required_authority: "owner"` into the
approval's `request_payload`; any other declared value refuses
(`approval_authority_unknown`). No producer declares it yet; it exists so
future equity, debt, or litigation actions can.

## Auto-suspension

A model-driven principal is suspended, fail closed, while either holds:

- `oversight_vacant`: the company has no active human owner.
- `agent_malfunction_flagged`: an unlifted row in
  `company_agent_malfunction_flags` names the agent.

Suspension is derived on every read; it is never written into agent status, and
a read failure refuses. Human principals are never suspended, so an owner can
always act. Every refusal is `423 Locked` with `code: "agent_suspended"` and the
`reason_code` above.

| Seam | Check | Receipt |
| --- | --- | --- |
| Worker dispatch (`execute_worker_inner_for_surface_timed`) | vacancy, or a flag on the acting or assigned agent | `task_events.dispatch_refused` |
| Tool calls inside a run (`ToolRegistry` policy compose) | live read for the run's agent; the sealed contract cannot see a mid-run suspension | task-trail `tool_denied` |
| Principal-token mutations (`require_company_mutation_admission`) | model-backed agent rows and `agent_bindings` principals | `governance_events.company_mutation_refused` |
| Signed run-capability `authorize` | the grant's principal | `governance_events.run_capability_action_refused` |

Settlement of an already-authorized run-capability action stays open so its
outcome is still recorded.

## Operating it

```text
GET  /api/company/companies/:company_id/agents/:agent_id/suspension
POST /api/company/companies/:company_id/agents/:agent_id/suspension        {"reason": "..."}
POST /api/company/companies/:company_id/agents/:agent_id/suspension/lift   {"reason": "..."}
```

- Any active human owner or admin may flag a model-backed agent; repeating the
  flag while one is open is idempotent. Flags cannot be raised on human rows.
- Only an owner may lift. A lifted flag is final; a new incident is a new flag.
- Flag rows are evidence: the database refuses any rewrite except the single
  lift, and the runtime role has no `DELETE`.

**Restoring a company with no owner.** Promote or create a human agent as
owner with an admin principal (succession), or, if the company has no usable
owner/admin credential at all, use the existing root-transport owner recovery
on `POST …/work-packages/principal-tokens`.