A risk-tier model for letting software repair agent access automatically without turning zero-touch operations into zero control.
Not every fix deserves the same authority
Updating a generated catalog file is not equivalent to changing DNS or a global robots policy. A trustworthy autopilot classifies the mutation before deciding whether it can act.
Green changes: bounded and reversible
Generated llms.txt updates, agent sitemap refreshes, and additive product context can usually run automatically when schema, link, privacy, and rollback gates pass.
Orange changes: canary first
Route changes, broad collection edits, and edge rules can affect real traffic. Deploy them to a limited surface, observe explicit success criteria, and promote only when evidence is clean.
Red changes: policy or explicit consent
DNS, sensitive robots directives, protected access, and security controls need durable authorization. A maximum-autonomy policy can reduce repeated approvals, but it should never erase ownership boundaries.
Zero touch still needs proof
Every automated mutation should retain before-and-after evidence, the policy decision, validation output, deployment identity, and tested rollback. Automation becomes trustworthy when it can explain exactly what changed and undo it.
Run the ReachPlane access check to turn the concepts in this guide into evidence from your own website.