The uncomfortable question every enterprise asks about autonomous operations is not "can it fix things?" It is "what stops it doing something catastrophic at 3am when nobody is watching?" GoalSet is our answer, and it is deliberately unglamorous: the AI does not get to decide what it is allowed to do.
The core inversion
Most agent architectures give a model a set of tools and let it reason about which to invoke. That is fine for a coding assistant. It is unacceptable for a system with root on production database servers, because the safety guarantee reduces to "the model was well-behaved during evaluation."
GoalSet inverts this. Every action the platform can ever take exists as a declared policy object, authored by a human, reviewed, and cryptographically signed before it enters the runtime. The AI's role is diagnostic: given a set of signals, identify the incident class and select the matching policy. If no signed policy matches, the outcome is escalation to a human — never improvisation.
Anatomy of a policy
A GoalSet policy is a declarative object with six mandatory sections:
- Match criteria — the signal signature and asset scope the policy applies to.
- Preconditions — assertions that must hold at execution time, re-evaluated immediately before the action runs.
- Action — the exact command, script, or API call, with parameters bound from the incident context.
- Blast radius — the maximum set of assets this policy may touch in one execution, plus a rate limit.
- Rollback — the inverse operation, and the state capture needed to make it possible.
- Approval class — autonomous, notify-and-act, approve-then-act, or human-only.
The rollback section is not optional and cannot be empty. A policy without a defined inverse cannot be assigned an autonomous approval class, full stop. This single rule eliminates most of the actions people are afraid of.
The execution pipeline
When signals arrive, the request travels through six stages, and any stage can halt it:
- Normalise — raw telemetry is reduced to a canonical incident signature.
- Diagnose — the AI layer proposes an incident class with a confidence score and supporting evidence.
- Match — the policy engine finds signed policies whose match criteria the incident satisfies. Deny by default: zero matches means escalate.
- Gate — confidence threshold, approval class, maintenance window, change freeze, and blast-radius checks are applied.
- Verify — preconditions are re-evaluated against live state, not against the state at alert time.
- Execute and observe — the action runs, state is captured for rollback, and the platform watches for the expected recovery signal.
Stage five matters more than it looks. Alerts age. An alert raised four minutes ago may describe a condition that has already self-resolved, or one that has escalated into something the policy was not written for. Re-evaluating preconditions against live state immediately before execution prevents the classic automation failure of fixing a problem that no longer exists — or fixing the wrong one.
Confidence gating
Every diagnosis carries a confidence score derived from signature match strength, historical resolution success for that signature on that asset class, and signal completeness. Policies declare a minimum confidence. Below it, the action downgrades — an autonomous policy becomes approve-then-act rather than simply failing.
This downgrade behaviour is what makes the system usable in practice. A binary allow/deny gate produces either reckless automation or an escalation flood. Graceful degradation keeps a human in the loop precisely when the machine is least sure.
Audit as a first-class output
For every decision — including decisions not to act — GoalSet writes an append-only record containing the input signals, the diagnosis and its evidence, the policies considered and why each matched or did not, the gate results, the precondition evaluation, the command executed, the captured rollback state, and the observed outcome.
These records are hash-chained, so tampering is detectable, and they are the artefact auditors actually want. In three regulated deployments, the audit trail has been the single feature that moved the security review from months to weeks, because it answers "prove what happened and why" without anyone reconstructing it from logs.
What GoalSet deliberately cannot do
- It cannot author a policy. Policy creation is a human workflow with review and signature.
- It cannot widen its own blast radius or exceed a declared rate limit.
- It cannot execute during a declared change freeze, regardless of confidence.
- It cannot run an action whose rollback state capture failed.
“A governance layer that the AI can talk its way past is not a governance layer. It is a suggestion.”
Priya Ramesh, CTO