E.16:7 - Consequences

• Testability. Budget use is checkable against declared tokens/envelopes; Work-anchored ledger entries support audit; PauseAutonomy stops autonomy-gated steps.
• Comparability. UTS surfaces autonomy metadata for fair selection & parity.
• Safety. Guards are hard gates; depletion halts further autonomy‑gated Work.

E.16:7.1 - SoTA-Echoing — bind a budget decision to the proposed action

Practice question. Is an existing release policy and error-budget ledger enough to permit an autonomous promotion or override? The selected line reuses those controls while checking the proposed action, current allocation and authority, available budget and applicable guards before performance. It then records the actual Work and consumption. A serious lighter alternative gates releases solely by the existing service-level error-budget policy and records their effects afterward. That is sufficient when the release policy already supplies every action/authority condition needed by the use.

The Google SRE Workbook’s Example Error Budget Policy, 2018 is the concrete comparator: its four-week budget can freeze changes, explicitly excepts P0/security fixes and supplies an escalation route. Adopt policy-bound depletion and explicit exception handling in S2, S4 and S5. Adapt the budget to the exact autonomous action and current authority in S1–S2, rather than inferring those facts from the remaining service budget. The cited example is a bounded release policy, not a general autonomy standard or proof of the completeness of a particular gate.

Show-B gives the decisive case: a release can be within its error budget while the required allocation overlap remains unknown. Budget-only permission would miss that unresolved premise; the explicit ReleaseEntryProfile-E1 blocks until it is established. A changed window reopens the affected permission, while S3 records consumption only after actual performance. Show-A adds a real pause/resume authority and depletion stop. The same existing policy, ledger and allocation records can supply these inputs; a second accounting system adds no value when their meanings and exact references are already present. The extra work is resolving a current action/allocation question, not copying the budget into another form.

Reject treating a declared pause interface as proof that a learning agent has no incentive to resist interruption. Orseau and Armstrong’s Safely Interruptible Agents, revised October 2016 supplies the distinct learning-theoretic question and results under stated agent and learning assumptions. It does not establish E.16’s runtime enforcement or override authority. S4 requires an effective override path; any stronger incentive or learning claim needs its own applicable analysis. Scout/probe/commit partitioning in S1.A is a local budget-control rule, with no claim here that unnamed agentic-search research proves its effectiveness.

At comparable operational effort, the selected line wins only when an action-sensitive premise could change permission: it uses the same budget evidence and adds that check before harm can follow the proposed action. For a policy already covering it, reuse the existing decision and accounting basis while respecting their currentness. Reopen when the action rule, authority/allocation policy, budget window or override mechanism changes, or when evidence shows a bypass or a cheaper control retaining the same required distinctions. No error-budget policy, interface declaration or interruption theorem alone establishes general autonomous-system safety.

E.16:7.2 - Common Anti-Patterns and How to Avoid Them