Autonomy is a product decision, not a model capability.
An agent may be able to take an action without being ready to receive authority over it. Separate what the model can do from what the product should allow, then match authority to consequence.
Grant the lowest level of autonomy that delivers the outcome. Raise authority only when evidence shows the system can stay safe, legible, and recoverable.
When signals conflict, choose the lower level, or split the workflow so low-risk steps proceed while high-impact steps stay under review.
The five levels
Higher is not better. Each level changes who decides, acts, and monitors. Each section includes what to build and patterns that put it into the product.
Suggest
- Can the agent help without taking any action?
- The agent never takes the action. It only surfaces options you can ignore.
- A single pushy recommendation with no alternatives, or a suggestion that looks like a completed action.
- Ideas, rankings, or next steps where a wrong suggestion is cheap to ignore.
- Show why this was suggested
- Offer alternatives, not one answer
- Let people dismiss it with no penalty
| Role | Who |
|---|---|
| Decides | You |
| Acts | You |
| Monitors | You |
Suggest / Confirm / Execute
Map suggest, confirm, and execute onto one product control so L1 stays advisory.
Draft
- Can the agent prepare work that only ships when a person finishes it?
- The agent prepares an artifact, but nothing ships until you edit and intentionally complete it.
- A draft that auto-sends, edits durable records, or hides that side effects are still blocked.
- Emails, docs, code, or plans that must not go out until a person finishes them.
- Mark it clearly as a draft
- Make every part editable
- Block side effects until publish
| Role | Who |
|---|---|
| Decides | You |
| Acts | You finish |
| Monitors | You |
Chat Artifacts
Keep drafts editable and side-effect free until a person intentionally publishes.
Confirm
- Is the agent ready to act, but still paused until a person approves?
- The agent is ready to act, but stays paused until you approve the exact scope.
- Approve without a preview of impact, no deny or edit path, or silent re-plans after the user said yes.
- Send, spend, delete, or change access: actions with real consequences that need a yes first.
- Preview exact impact before approve
- Allow edit, deny, or cancel
- Re-ask if the plan changes
| Role | Who |
|---|---|
| Decides | You approve |
| Acts | Agent after OK |
| Monitors | You |
Human in the loop
The approval gate when the agent is ready to act but a person still decides.
Bounded
- Can the agent run alone inside hard limits and escalate on exceptions?
- The agent runs on its own inside hard limits, and escalates when it hits an exception.
- Soft limits the agent can ignore, no interrupt, or exceptions that fail silently without an owner.
- Repeatable work where the agent can run alone inside budgets, allowlists, or timeboxes.
- Hard limits: budget, scope, stop rules
- Escalate when uncertain
- One-click interrupt and rollback
| Role | Who |
|---|---|
| Decides | You set policy |
| Acts | Agent in bounds |
| Monitors | You on exceptions |
Per-Action Autonomy
Different actions in the same product can sit at different levels inside hard limits.
Monitor
- Can the agent operate continuously while people govern policy and anomalies?
- The agent operates continuously. People govern policy and anomalies, not every step.
- An always-on agent with no visible status, no anomaly owner, or no safe shutdown path.
- Stable, well-owned operations where people oversee the system more than each action.
- Always-on status that it is running
- Anomaly alerts with a clear owner
- Safe shutdown and reauthorization
| Role | Who |
|---|---|
| Decides | You set policy |
| Acts | Agent |
| Monitors | You + systems |
Autonomous Mode Display
When the agent runs without asking, that state has to be unmistakable.
Match the risk of one action to an autonomy level.
Score impact, reversibility, reliability, sensitivity, and detection. The tool recommends a level from Suggest to Monitor, plus who should decide, act, and monitor.
If this goes wrong, how bad is it?
Can you undo it?
How proven is the agent at this task?
How sensitive is the context?
Can someone catch a bad outcome?
Cheatsheet
Eight checks before raising autonomy.
- Is this the lowest level that still delivers the outcome?
- Can people see who decides, who acts, and who monitors?
- Are side effects blocked until the level allows them?
- If the plan changes, does the product re-ask or re-bound?
- Is there a one-click interrupt, deny, or shutdown path?
- Are hard limits real (budget, scope, allowlist), not soft preferences?
- When autonomy rises, is status unmistakable and owned?
- Can someone recover work after a bad autonomous action?