TENURE

TENURE is an earned autonomy engine for e-commerce customer resolution and refund agents. Autonomous dispute agents currently present a fundamental operational dilemma: under-trusting them forces human staff to manually re-read every ticket, while over-trusting them allows silent merchant policy shifts to cause catastrophic financial leakage. Static prompt guardrails neither adapt to real-world performance nor expire when conditions change. TENURE replaces static prompt rules with mathematical, empirical governance: 1. Operational Partitioning: Workload execution is divided into 56 discrete operational cells (Case Type × Order-Value Band). Trust is never granted globally; it must be earned per cell. 2. Wilson Confidence Gates: Every cell starts at Level 0 (shadow mode). A cell earns promotion to Level 1 (suggest) or Level 2 (act with audits) only when a continuity-corrected Wilson lower bound statistically proves non-inferiority against human baseline agreement. The model cannot self-authorize trust. 3. Bernoulli CUSUM Drift Containment: Continuous monitoring tracks labelled outcomes. If return policies drift overnight and error rates spike, the CUSUM test statistic breaches threshold h, automatically demoting the cell back to human review (Level 0) with zero manual intervention. 4. Cryptographic Ledger: Every decision, promotion, and demotion is immutably logged to an append-only SHA-256 hash-chained ledger, verifiable offline via CLI in milliseconds. Evaluated with Google's Gemma-4-31B-IT on the AMD Token Factory, TENURE achieved a 96.4% agreement rate (482/500 held-out cases) with 678 prompt tokens/sec throughput, delivering €693 net monthly savings and a 45.1% reduction in human escalations.