Not on their own. Autonomy levels are useful vocabulary, but one level per agent is too coarse. Risk sits in each capability, and mostly in how hard its effects are to reverse. The same agent can safely send a delivery update unassisted and should never release a payment unassisted. Govern per capability, by reversibility, with evidence that expires.
What do autonomy levels offer?
They give people a shared scale for describing how much an agent does on its own, from fully manual to fully autonomous. The Cloud Security Alliance, for example, has published autonomy levels for AI agents running from 0 to 5. A scale like this helps conversations: a board can ask "what level are we at?" and get a meaningful answer. The concept is set out in what autonomy levels for AI agents are and how they work.
Where do they fall short as a control?
One number per agent hides the spread. A support agent might look up orders, draft replies, send status updates, issue credits and change addresses. Those five actions have very different risks. A single level is either too high for the riskiest or too low for the safest.
They describe, they do not prove. Assigning a level says how much an agent is allowed to do. It does not say whether the agent has shown, on your cases, that it does that well.
They do not expire. A level set at launch stays until someone changes it. Agents drift, inputs change, models update. Evidence from six months ago may no longer hold.
They ignore reversal. The question that matters most in a regulated business is what happens if the action is wrong. A message can be followed by a correction; a settled payment often cannot be recalled.
What should you govern by instead?
| Capability | How reversible | Sensible starting depth | Stays with a person |
|---|---|---|---|
| Look up an order | Nothing to reverse | 1, read | None |
| Draft a reply | Not sent yet | 2, draft | Sending |
| Send a delivery update | Easy to correct | 3 after certification | Exceptions |
| Issue a small credit | Reversible with effort | 3 within limits | Credits above the limit |
| Change payment details | Hard to detect if wrong | 2, held | Verification and approval |
| Release a payment | Often irreversible | 4 only with strong evidence | Most cases |
The table uses the depth each action needs: 1 read, 2 draft, 3 execute routine work within bounds, 4 move money or take hard-to-undo actions, 5 coordinate other agents. The point is not the specific numbers but that each row gets its own answer, decided mainly by reversal.
What does this look like in practice?
Take a retail bank whose customer-service agent was labelled "level 3, conditional autonomy" at launch. Within that label it could block cards, send statements and update contact details. A review found that blocking a card is easy to undo and urgent, sending a statement to the address on file is low risk, and updating contact details is a common first step in account takeover.
Moving to the depth each action needs, the bank kept card blocks and statements at depth 3, and moved contact changes to depth 2: the agent drafts, a person approves after verifying. The agent did more on its own in some places and less in others. The bank recorded each change using an autonomy change request and mapped the result in an autonomy decision matrix.
How does supervision fit?
Many teams use "supervised autonomy" to mean an agent that acts while a person watches. It can be a useful stage, but a person watching a stream of actions is a weak control at volume. Holds at the moment of action, for the capabilities that need them, are stronger; see what supervised autonomy is. The underlying principle, that autonomy is a question about reversal, is argued in full in autonomy in regulated industries.
Where Pryme fits
Pryme does not govern by one level per agent alone. Each action needs a depth; the agent's depth is earned per customer, on that customer's own cases through Attest, up to its role's ceiling, and an action is allowed only when that depth reaches what it needs. Certificates lapse after 90 days, which drops the agent to depth 1 the same day, as does a run that clears no depth.
Questions people ask
Should we stop using autonomy levels?
No. Keep them for communication. Use the depth each action needs, set by reversibility, and the depth the agent's evidence earns, as the control underneath.
Does a depth for each action create too much to manage?
It creates more entries, but each is simpler to decide. Most agents have a handful of capabilities, and the table that results is easier to defend than one number.
Who decides how reversible an action is?
The process owner, with risk and operations. Reversibility depends on your systems and rails, so it is a business judgement, recorded and reviewed.