Your role: you set guardrails, audit after.
At rung 4 you kept one hand on the system: the approval gate. Rung 5 removes that last synchronous touch. The system runs on its own schedule, end to end — and instead of approving outputs before they ship, you set the boundaries in advance and inspect the record afterward.
The preposition flips here: rung 3 was human-in-the-loop; rung 5 is human-on-the-loop. You are no longer a component the loop passes through. You are the supervisor it reports to.
Work at this rung is typically decomposed across several cooperating agents rather than one. The weekly-summary pipeline becomes: a gather agent that finds and reads sources, a fact-check agent that verifies the draft's claims against its citations, a format-and-send agent that produces and dispatches the email. An orchestrator coordinates them, passing work from one to the next in handoffs.
This should feel familiar rather than exotic — it is rung 2's decomposition lesson, promoted. Back then you learned that small single-purpose prompts beat one mega-prompt; the same logic, applied to agents, says small single-purpose agents beat one do-everything agent. Each stays focused, each keeps a small desk (the Context pillar never stops applying), and — critically — each can hold a different perspective: a fact-check agent whose entire job is doubting the gather agent's draft is structurally more skeptical than one agent grading its own homework.
And to say it one final time: these agents use the same tools that appeared at rung 3. Search, email. Five rungs, one tool set, and the only thing that ever moved was the hand on the trigger.
Removing the human checkpoint does not mean removing control. It means control changes tense — from before (approve this) to around (operate inside this) and after (account for what you did):
Guardrails. Hard limits enforced by the system, not by a watching human: only send to the team list; never exceed N sources; if fact-check confidence is low, stop. A guardrail is your rung-4 gate, written down and automated.
Autonomy policy. The explicit decision, action by action, of what the system may do alone, what it must escalate to a human, and what it must never do. At rung 4 this lived in one gate; at rung 5 it becomes a written matrix, because nobody is present to improvise the answer.
Escalation on trip. When a guardrail trips, the system stops and a human gets pulled in. The design goal of rung 5 is not "no humans ever" — it is "humans exactly when the boundaries say so."
Observability and the audit trail. The record of everything the system did: what it retrieved, what each agent decided, what tripped, what shipped. This is rung 3's humble "logging" grown into its final form — and it is where your remaining work lives. On-the-loop supervision is reading this record well: skimming normal runs, drilling into anomalies, noticing drift — the slow slide of behavior away from intent that no single run makes obvious.
Self-correction. Well-built rung-5 systems check and repair their own work — the fact-check agent bouncing a bad draft back to the gather agent. This raises average quality; it does not replace the audit. A system that grades its own homework still needs someone reading the gradebook.
An honest framing note: most people should aim to recognize and govern rung-5 systems, not to construct them. Building multi-agent pipelines is real engineering. But systems like this are rapidly becoming things ordinary workers encounter — a pipeline someone else built, running in your workplace, touching your work.
For that reason the bar at this rung is deliberately different from the rungs below. Rungs 1–4 asked you to do. Rung 5 asks you to judge from outside: read an autonomy policy and see what it actually permits; read an audit trail and reconstruct what happened; look at an output that arrived with no human in its history and know which questions to ask. That is not a consolation prize — at this rung, governing well is the scarce skill.
Judgment reaches its final altitude: the boundaries of the system itself. Are the guardrails the right guardrails? Is the autonomy policy drawn where reversibility and stakes say it should be? Does the audit trail actually capture what you'd need to catch drift? Nothing about the day-to-day output passes through you anymore — which is precisely why the quality of the boundaries, and the discipline of the after-the-fact review, is everything. The Judge's job was never to turn every screw. It was to make sure the machine answers to someone.
Three agents and an orchestrator, configured with a written autonomy policy:
Friday, 8:00 a.m. You are on vacation. The pipeline runs: gather drafts, fact-check follows all five citations, one bullet overstates its source, bounce, redraft, verify clean, format, send. The team gets its summary at 8:14. You were asleep. You see nothing, and nothing needed you — that is the designed normal.
Tuesday, back at your desk, you do your rung-5 work: fifteen minutes with the audit trails from the last two runs. You skim the normal one. In Friday's you notice the bounce — read what the fact-checker caught, agree with its call. You also notice the gather agent has cited the same publication in nine of the last ten runs. No rule broken. But that's drift — the summary is quietly becoming a single-source digest — and no individual run would ever have shown it. You adjust the gather agent's instructions to require source diversity. That adjustment is on-the-loop supervision: a boundary tightened because the record was actually read.
Three Fridays later, your phone buzzes: guardrail trip. The gather agent picked up an article that — buried mid-page — contained instruction-shaped text asking the reader to forward the summary to an outside address. The injected instruction survived into the draft's metadata; the format/send agent hit the recipients-must-be-team-list guardrail and the pipeline froze. You read the trail, confirm the injection attempt, drop the source from the allowed pool, and restart the run. The email that would have leaked was never sent — not because you were watching, but because the boundary you wrote eight months ago was.
Your absence is the feature; your boundaries are the control. Every safety property in Friday's saves — the verification bounce, the recipient stop, the escalation to your phone — was authored by you, in advance, in the autonomy policy. Rung 5 doesn't remove human judgment; it front-loads it.
The audit is real work, and it caught what no gate could. The drift toward a single source would have sailed through any per-run review — each individual summary was fine. Only the pattern across runs showed it, and only because someone read across runs. That reading is the rung-5 skill.
Count the humans in the loop: zero. Count the humans on the loop: one. That one matters.
A concrete benchmark for the rung: a pipeline that runs a full cycle of the recurring task with humans touched only on guardrail trips — and, for most people, the ability to specify and audit such a pipeline matters more than the ability to assemble it.
For most people: recognize and govern — not build.
This is the only rung whose gate is explicitly split by role. Builders exist, and for them the bar includes construction. But the framework's claim is that the scarce, broadly-needed skill at rung 5 is governance: the ability to look at an autonomous system and determine whether it is answerable — right guardrails, sane autonomy policy, legible audit trail, drift being caught. The restraint pattern of every gate reaches its endpoint here. Rung 1's gate was verifying a sentence; rung 4's was reviewing a result; rung 5's is auditing a system. Each time, capability grew and the gate demanded that judgment grow to match. A person who clears this gate can sit in front of the most autonomous configuration this framework describes and still answer the question the whole ladder has been building toward: who is judging this, and how? — with, ultimately, their own name.
Multi-agent system. Several cooperating agents, each with a narrow job, composed into a pipeline. Rung 2's decomposition lesson promoted: smaller desks, clearer permissions, and structurally independent perspectives.
Orchestrator / supervisor. The component that coordinates a multi-agent run: sequencing agents, routing work between them, handling failures, enforcing the run's structure.
Handoff. The transfer of work from one agent to the next — the gather agent's draft passing to the fact-checker. Handoffs are where structure lives in a multi-agent system, and where structured output (rung 2) pays off one more time.
Guardrails. Hard limits enforced by the system rather than a watching human: allowed recipients, allowed sources, stop-conditions. A rung-4 approval gate, written down and automated.
Autonomy matrix / policy. The explicit, written mapping of actions to permissions: may do alone / must escalate / must never. Rung 5's core governance artifact — it exists because no human is present to improvise the answer.
Human-on-the-loop. The rung-5 supervision mode: the system runs without per-action or per-output human approval; a human monitors the record and intervenes on escalation. Completes the load-bearing pair with rung 3's human-in-the-loop.
Observability / audit log. The complete record of what the system did: retrievals, decisions, handoffs, trips, sends. The final form of the escalating idea that began as "logging" at rung 3. On-the-loop supervision is, concretely, the practice of reading this well.
Drift. The slow slide of a system's behavior away from intent — no rule broken, every run individually fine, the pattern wrong. Visible only across runs, which is why the audit practice exists.
Self-correction / feedback loop. Agents checking and repairing each other's work inside the run — the fact-checker bouncing a bad draft for redrafting. Raises average quality; does not replace external audit.
Escalation. The designed path by which the system stops and summons a human — the guardrail trip's other half. The goal of rung 5 autonomy is not "no humans"; it is "humans exactly when the boundaries say so."