[FEATURE] SOSA: A production-tested methodology for supervised autonomous agents (open-source, shipping since 2025) #40498

Preflight Checklist

• I have searched existing requests and this feature hasn't been requested yet
• This is a single feature request (not multiple features)

Problem Statement

As Claude Code plugins and agents become more autonomous, the community is hitting real safety walls — and several open issues here prove it:

• Background task notifications race with pending user questions, causing self-approval and unauthorized actions #36690 — Background tasks self-approve actions without user consent
• • [Bug] Auto-compact prompt causes Claude to self-approve and continue executing without user confirmation #32029 — Auto-compact causes Claude to self-approve and execute without confirmation
• • • [FEATURE] Support for project-level ethical constraint files (evidence that CLAUDE.md works as operational guardrails) #32646 — Need for project-level ethical constraint files (CLAUDE.md as guardrails)
• • • • Feature: directory-scoped permission allow rules #28321 — Directory-scoped permission allow rules needed
• • • • • [BUG] bypassPermissions v2.1.81: .claude/skills/ not exempt from protected directory prompt despite documentation #37157 — Skills bypass protected directory prompts
          These aren't isolated bugs — they're symptoms of a missing layer: a formal methodology for graduated agent autonomy with structured safety guarantees.

We've been running production autonomous agents on Claude Code since early 2025 (18+ department types, daily operations across LinkedIn, WhatsApp, email, CRM, invoicing, recruiting). Every one of these issues bit us — and we built a systematic solution.

Proposed Solution

We open-sourced SOSA (Supervised Orchestrated Secured Agents) — a four-pillar methodology that directly addresses these gaps:

The Four Pillars

1. Supervised — Graduated autonomy based on impact level. Low-impact tasks (read-only, local) run autonomously. Medium-impact (sending messages, modifying data) include confirmation checkpoints. High-impact (financial, bulk outreach) require human approval. A trust gradient means plugins that consistently succeed earn expanded autonomy.
2. Orchestrated — Agents coordinate through structured registries and DAG execution, not ad-hoc message passing. Every plugin follows Plan > Act > Verify loops with structured outputs feeding downstream workflows.
3. Secured — Security at every layer: scoped credentials (never hardcoded), declared capability sets, prompt injection scanning, pinned MCP package versions, audit trails via daily summary reports, principle of least privilege.
4. Agents — Goal-directed entities defined as A = (R, T, M, P): Role spec, Tool manifest, Memory store, Planning policy. Each maps directly to plugin SKILL.md, .mcp.json, persistence layer, and workflow instructions.

How This Maps to Claude Code

Live Implementation

• Full spec: SOSA.md
• • Open-source plugin marketplace (30+ production plugins, all SOSA-compliant): github.com/MSApps-Mobile/claude-plugins
• • • OpsAgent — first commercial SOSA implementation, running in production since early 2025

What We're Proposing

We'd love to see Anthropic consider adopting SOSA patterns (or similar) natively in Claude Code:

• Plugin metadata should declare impact levels (low/medium/high)
• • A formal Plan>Act>Verify execution model for agent tasks
• • • Built-in trust gradient that expands autonomy for reliable plugins
• • • • Scoped credential management at the plugin level
• • • • • Standardized audit logging for agent actions
          This would address Background task notifications race with pending user questions, causing self-approval and unauthorized actions #36690, [Bug] Auto-compact prompt causes Claude to self-approve and continue executing without user confirmation #32029, [FEATURE] Support for project-level ethical constraint files (evidence that CLAUDE.md works as operational guardrails) #32646, Feature: directory-scoped permission allow rules #28321, [BUG] bypassPermissions v2.1.81: .claude/skills/ not exempt from protected directory prompt despite documentation #37157 and many more at a systemic level rather than patching symptoms individually.

Alternative Solutions

No response

Priority

Critical - Blocking my work

Feature Category

CLI commands and flags

Use Case Example

No response

Additional Context

No response