Trust System: How to Give an Agent Autonomy Without Losing Control
The fundamental problem of autonomous agents isn't technical — it's trust. How do you delegate critical tasks to an AI without constant supervision? Dynamic trust scores, per-action thresholds, and automatic human escalation.
Gonzalo Monzón
July 7, 2026 · Series: Cognitive OS — The Complete System (2/3)
TL;DR
We know the LLM can do the task. The question is: will it do it correctly? The Trust Stack answers with 4 layers: (1) User Profile — persistent profile of each user in PDB, (2) Trust Score — 0-10 rating that evolves with each interaction, (3) Action Thresholds — each action requires a minimum score that varies by context, (4) Escalation Protocol — if there isn't enough trust, the agent prepares a recommendation and waits for the human. With temporal decay: trust is earned through practice and lost without use.
Trust, not capability
We know the LLM can do the task. The question is: will it do it correctly? What if it makes a mistake? What if it hallucinates an answer that damages a user relationship?
The fundamental problem of autonomous agents isn't technical — it's trust. We built the Trust Stack to answer exactly that: 4 layers that allow gradual delegation, measuring and adjusting autonomy in every interaction.
The 4 layers of the Trust Stack
User Profile
Every user has a persistent profile in PDB with communication style, autonomy preferences, knowledge areas, and correction history. Zalo doesn't treat everyone the same: it knows Gonzalo prefers direct answers, that a client might need more context, that a colleague expects a technical tone.
Trust Score (0-10)
Each agent has a dynamic trust score (starts at 5.0 — neutral) that evolves with every interaction. It's not global — it's specific per action type. Zalo might have trust 9.0 for classifying messages but only 6.5 for posting on LinkedIn.
| Event | Impact |
|---|---|
| Task completed correctly | +0.1 |
| Error or correction needed | -0.5 |
| Explicit positive feedback | +0.3 |
| Action that required escalation | -1.0 |
| Inactivity on an action type (7+ days) | -0.1/day |
Temporal decay: if an agent doesn't perform a certain action type for 7 days, the score decreases down to a minimum of 5.0. Trust is earned through practice and lost without use — like a language you don't practice.
Action Thresholds
Each action has a minimum threshold that varies by context. Reading isn't the same as executing:
Post on social media: threshold 8.0
Reply to a client: threshold 7.0
Classify a message: threshold 5.0
Execute internal task: threshold 6.5
Thresholds are automatically modulated based on who, what, when, and where. Reading an email from a known client might require only 4.0; reading one from a new client requires 6.0. If the trust score is below the threshold, the agent doesn't execute — it escalates to the human.
Escalation Protocol
When an agent doesn't have enough trust to act, it follows this protocol:
- 1. Prepares a recommendation with full rationale
- 2. Presents it to the human with clear options
- 3. Waits for confirmation or rejection
- 4. Records the decision as learning for future occasions
Over time, the human confirms fewer times and the agent gains autonomy. It's like training a new employee: at first you supervise everything, then you gradually delegate.
What if the trust score plummets?
If an agent makes a serious mistake, the score drops below all thresholds. The agent enters read-only mode: it can read, classify, and analyze — but not execute actions with external effects, and cannot write to PDB. Without this lock, a fallen agent could contaminate the system's shared memory. Recovery is manual: a human reviews what happened, corrects the profile, and restores the score.
Initial trust: from zero to autonomy
New agent, new profile: low trust score for everything (starts at 5.0). The first few weeks, the agent asks about almost everything. Each success raises the score. Each correction adjusts it.
To accelerate this process, the supervisor can pre-load trust rules per profile: "this user is technical, threshold 6.0 for code tasks", "this contact is premium, high priority". This lets the agent start with an initial trust context instead of starting from zero.
It's like training a new employee: at first you supervise everything, then you gradually delegate. The difference is that an AI agent learns faster — but it can also fail faster if there are no safeguards.
Autonomy with a safety net
Zalo operates with real autonomy. Gonzalo doesn't supervise every message. But if Zalo encounters a situation where it's not sure, it asks. And that's exactly what we want: an agent that knows what it knows, knows what it doesn't know, and has mechanisms to handle both cases.
Series: Cognitive OS — The Complete System (2/3)
← Previous
Cognitive OS — OverviewNext →
Episodic MemoryAll articles in the series:
And it needs memory
That's how the Cognitive OS remembers. Short, medium, and long-term memory with embeddings and semantic search. The series finale.
Cognitive OS Series — 3 articles. Cadences Lab © 2026.