A capability does not arrive in the operation with permission attached. It arrives supervised.
At the bottom of the ladder every single execution of that capability is proposed and a person decides. Nothing runs on its own, not because the execution is expected to be wrong but because there is no record yet, and without a record the question of whether it is right has no answer. The capability sits there doing the work under supervision, accumulating the only thing that moves it upward: hundreds of clean executions with a verifiable trail behind each one.
Verifiable is doing real work in that sentence. A clean run is not a run nobody complained about. It is a run where the record shows what was done, when, on what evidence, and with whose approval, and where the outcome can be checked against what was expected. A capability that performed well and cannot prove it has earned nothing. This is slower than trusting a competent operator's impression, and an impression is exactly the thing that fails silently.
Climbing is therefore gradual and expensive. Falling is neither. A single incident drops the capability straight back to supervision, immediately, not one rung at a time.
The asymmetry looks harsh until the alternative is examined. A graduated demotion, one step down for one failure, assumes something that is almost never true at the moment of failure: that the failure is understood. When an incident surfaces, what is known is that something went wrong. What is not known is how wide the cause is. Whether it was a bad input, a changed platform behaviour, a rule that was always fragile and had never been stressed, or a reasoning error that had been producing near misses for weeks and finally produced a hit. Demoting by one rung is a bet that the cause is one rung wide. That bet is placed with no information, at the moment the operation knows least, about a system that has just demonstrated it can surprise the people who built it.
Dropping to the bottom makes no such bet. It says the trust rested on a record, the record now contains an event nobody anticipated, and the trust has to be rebuilt from the beginning against a record that includes it. If the investigation shows the cause was narrow, the climb back is quicker, because clean executions accumulate fast in a capability that was already close to correct. The system pays for the caution in time rather than in permanent capacity.
Some action types never reach the top of the ladder at all. Refunds are the clearest case. A refund can be executed correctly, at the right amount, to the right customer, and still be the wrong decision, because the judgment inside it is about a relationship rather than about a rule. No volume of clean executions changes that, so no length of clean record moves it. It stays permanently in human approval, and the ceiling is written into the design rather than left standing as current policy. The distinction matters, because a policy is the thing an operator relaxes when it becomes inconvenient.
The cost has to be admitted, since describing a safety property without pricing it is advertising.
This makes the operation slower than it could be. A capability is usually reliable well before it is provably reliable, and in that gap it runs supervised, which means it runs at the speed of a person's attention rather than at the speed of the system. Chances pass during that gap. When a rung is lost, the same capability that ran unattended last week is back to being proposed one execution at a time, and that is a genuine reduction in throughput arriving at exactly the moment the temptation to make an exception is strongest, because a failure always feels understood the day after it happened.
The trade is not negotiable, and the reason is narrower than a general fondness for caution. This operation reports one number and claims to be the only party accountable for it. That claim survives only if the permissions the operation runs under are fixed and inspectable rather than adjusted according to how confident the operation currently feels. An operator that widens its own authority after a good quarter and narrows it after a bad one is not accountable, it is marking its own paper. The ladder exists so that the authority in force at any given moment is a fact sitting in the record rather than a mood.
There is a second reason, less structural and more practical. A system trusted quickly is a system whose failure rate gets discovered by its customers, and that discovery is not reversible the way a bad month is reversible.
If you would rather run slower on an inspectable record than faster on somebody's confidence, ask first what sits permanently in human approval.