Promotions are dead. Trust budgets replace them.

A promotion is a single event that pretends to answer a thousand questions. On Friday someone is a senior engineer who needs sign-off to touch the billing code. On Monday they’re a staff engineer who doesn’t. Nothing measurable changed over the weekend. The title moved because a committee decided it should, and from that one decision the company now infers what this person can be trusted to do across dozens of situations nobody actually evaluated. We do this with people. We are about to do something far stranger: try to do it with software agents, where the gap between “got the title” and “earned the trust” is wider and more dangerous than it has ever been.

There’s a better unit than the title. We think the promotion was always a clumsy stand-in for it.

You won’t promote an agent; you’ll widen its trust budget one verified task at a time, and the same ledger should govern your people.

What a promotion is actually trying to do

A promotion bundles three things that have nothing to do with each other: more pay, a new label, and more permission to act without asking. The first two are real. The third is the one that actually changes how the company runs, and it’s the one we get most wrong.

Think of “permission to act without asking” as a budget, a running balance of how much the organization will let you commit, decide, or move before someone else has to bless it. A junior person has a small budget: they can spend a few hours on a hunch, draft a customer reply, suggest an approach. A senior person has a larger one: they can sign off on an architecture, approve a refund, send the contract. The budget is the real thing. The title is just a coarse, occasional snapshot of it.

The title is a label we attach to trust once a year. The trust itself moves every single day.

And here’s the problem with snapshotting a continuous thing once a year: the snapshot is always wrong. It’s wrong on the way up, the person earned the wider budget months before the committee caught up. And it’s wrong on the way down, someone keeps a budget that the last three quarters of evidence say they shouldn’t. The title lags the trust in both directions, because trust is a stream and a promotion is a photograph.

The naive way to give an agent autonomy

So now you bring a software agent into this. The naive instinct, and we’ve watched smart teams reach for it every time, is to treat autonomy as a setting. A toggle. You build the agent, you test it a few times, it looks competent, and you flip it to “autonomous.” Title granted. It can now act on its own.

The felt pain arrives about a week later, and it’s always the same shape. The agent does ninety-seven things correctly and the ninety-eighth is a confident, fluent, completely wrong action taken at full authority, a message sent to the wrong list, a record updated that shouldn’t have been, a decision made on a case it had never actually seen before. The toggle had no memory of how the agent earned the trust, so it had no idea where the trust ran out. A binary switch can’t encode “good at refund approvals under a certain amount, untested on anything above it.” It only knows on or off. And off-or-on is exactly the resolution at which a new hire is most likely to hurt you.

This is the promotion bug, ported to software. We took the worst property of how we trust people, the coarse, all-at-once grant, and we automated it. The agent didn’t earn its budget across a hundred verified tasks. It got a title from a committee of one, on a Tuesday, because the demo looked good.

The fix isn’t a smarter agent. A smarter agent flipped to “on” just makes more confident mistakes faster. The fix is to stop granting trust as an event and start metering it as a balance.

The trust budget: trust as a meter, not a switch

Here is the unit we think replaces the promotion. You won’t promote an agent; you’ll widen its trust budget one verified task at a time, and the same ledger should govern your people.

A trust budget is a running balance, scoped to a specific kind of work, that grows with verified results and shrinks with failures. It has three properties the toggle doesn’t.

First, it’s earned, not granted. The budget starts near zero and goes up only when an action the agent took is checked and confirmed correct. Not “looked plausible.” Verified, a human confirmed it, or a downstream system did, or the outcome closed cleanly. Each verified task is a deposit. A hundred deposits in refund approvals buys a wide budget there and nothing anywhere else.

Second, it’s scoped, not global. An agent can have a generous budget for sorting and drafting and a near-zero one for anything that moves money or speaks to a customer in your name. The promotion’s great lie is that competence transfers across domains, that being good at one thing earns you authority over everything. A budget refuses that lie. Trust is always trust at something.

Third, it’s reversible, and quietly so. When a verified failure lands, the budget contracts for that scope automatically, with no awkward meeting and no demotion ceremony. The agent simply drops back to drafting-and-confirming where it used to be acting-and-reporting, and starts re-earning. Trust that can’t fall isn’t trust. It’s just a permission someone forgot to revoke.

You can picture the levels concretely. At the bottom, the agent may only read and suggest. Earn enough there and it may draft, and you confirm. Earn enough there and it may act, then tell you. And at the very top, for the narrow band of tasks it has gotten right a hundred times, it may simply do, and you read the result later. Nobody flipped a switch. The leash lengthened, one verified task at a time, exactly as far as the evidence reached and not one task further.

Why this needs to be the same ledger for people and agents

The temptation is to build the trust budget as an agent-governance feature, a clever way to keep the robots on a leash, and leave the humans on the old promotion cycle. We think that’s a mistake, and the mistake is instructive.

The reason you can run an agent on a metered, scoped, reversible budget is that every action it takes is logged and checkable. You know what it did, when, on what input, and whether the result held up. That’s the whole reason the budget can be earned honestly instead of granted by vibe. But notice: there is nothing about that property that is special to software. A refund a person approved either held up or it didn’t. An architecture call a person made either aged well or caused an incident. The evidence exists for people too. We just never bothered to keep the ledger, so we fell back on the once-a-year photograph.

When agents and people work on the same problems, and inside a company OS, they do, running two different trust systems is incoherent. One side earns authority continuously from verified outcomes; the other gets it in an annual lump from a committee. The agent’s budget will be more honest than the human’s title within a quarter, and everyone will feel it. The fix is not to dumb the agent’s system down to match the human’s. It’s to give the people the same dignity we’re about to give the software: trust that tracks what you’ve actually done, scoped to what you’ve actually done it at, that goes up the day you earn it instead of the Friday a committee gets around to it.

Give people the ledger we’re building for the agents. It’s more honest than a title, and it never makes you wait a year to be believed.

That’s not a downgrade for humans. It’s the opposite. The annual promotion is the system that makes you wait, that lets a brilliant quarter go unrewarded for eleven months because the calendar isn’t ready. A trust budget that moves the day you earn it is the most respectful thing a company can do with the evidence of your work.

The turn: what you stop being

Run a company on titles and someone has to be the committee. Someone holds the meeting, weighs the politics, decides who’s ready, and absorbs the resentment when the photograph comes out wrong. For most founders that someone is them, and it is one of the most thankless, least leveraged jobs they do, adjudicating trust by gut, once a quarter, for people and now for software, with no ledger to lean on and no way to be right.

A trust budget retires that job, and it retires it for both kinds of worker at once. You stop being the gut that decides who’s ready. The evidence decides, continuously, in the open, the same way for the agent that drafts the proposal and the person who closes the deal. What’s left for you is the part the ledger can never compute: deciding what counts as a verified result in the first place. What “good” means here. Which failures are fatal and which are how anyone learns. What you actually want this company to be trusted, by the world, to do.

That judgment, what’s worth earning trust at, is the human core of the whole system. A budget can meter trust flawlessly and still have no idea what’s worth trusting anyone to do. That part stays yours, and it’s the only part that was ever the real work.

---

That’s what we’re building at Apollo Space, a company operating system where authority is a budget you earn in the open, not a title a committee hands down, and the agent and the person are held to the same honest ledger. If you’ve ever watched a great quarter wait a year for a label to catch up, you already know the title was never the real thing. The trust was. Let’s start keeping the books on it.