97 of 100 approved without edits sounds like proof, but it only proves the agent did well while a person was watching. Once the approval step went away, the incentives and inputs changed, and the retest showed that "routine" meant something different to the agent than to the team.

Finding irreversible actions inside the routine bucket is the key result. I would sort actions by whether they can be undone before sorting by how often they are approved, since a frequent action that cannot be reversed still needs a human.

The chained privilege escalation is also a good reminder that each step can look harmless while the sequence is not.

At Ascendra Ventures we treat any expansion of an agent's autonomy as a new scope with its own acceptance tests, not a settings change. Did the Ridgeway team end up keeping approval for the irreversible actions only, or redraw the routine flag entirely?