An autonomy ceiling is the highest depth an AI agent may reach for a given capability, however well it performs. It is set in advance by the business, through its policy, and it caps what certification can grant. Evidence decides how much autonomy an agent has earned; the ceiling decides the most it may ever have. Where the two differ, the lower wins.
Why have a ceiling if depth is earned?
Because some decisions are not only about performance. An agent might handle payment releases flawlessly on every test case, and the business may still decide that payments above a set amount always need a person. That is a judgement about risk appetite, regulation and accountability, not about the agent's skill.
The ceiling records that judgement where the platform can enforce it. Without one, strong test results could lift an agent into territory nobody meant to delegate.
How does a ceiling work in practice?
Each capability has a ceiling, set per customer. Certification produces evidence for the agent and proposes a depth. The platform takes the lower of the two. If an agent earns depth 4 but the ceiling for refunds is 3, it operates at 3 on refunds. If the ceiling is 4 but the agent has earned only 2, it operates at 2.
Ceilings are best set before the agent is built, from an autonomy decision matrix that maps each action to its highest acceptable depth. For a brand-new agent, the first ceiling is usually conservative; setting the first ceiling for a new agent covers how to choose it. Raising it later is a deliberate, recorded decision, made through an autonomy change request.
What does that look like in an example?
A consumer lender sets the ceiling for its collections agent at depth 2 for payment plans: the agent drafts, a person agrees the plan. After months of strong results, the collections head wants the agent to agree standard plans itself. She raises a change request to lift the ceiling to 3 for plans within set terms. Risk approves it. The agent's existing certificate already showed the evidence, so it moves to depth 3 the day the ceiling changes. Non-standard plans keep a ceiling of 2.
How is an autonomy ceiling different from a customer ceiling?
The autonomy ceiling caps depth: how far the agent may act on a capability. A customer ceiling is the customer's own limit on what any action may involve, such as a maximum refund amount or a list of permitted counterparties. An agent at depth 3 for refunds still cannot refund above the customer ceiling. Both are bounds in the minimum chain; they limit different things.
How does a ceiling relate to graduated autonomy?
Graduated autonomy is the practice of raising an agent's independence in steps as evidence builds. The ceiling is where those steps stop. A well-run programme raises depth within the ceiling as certification allows, and treats lifting the ceiling itself as a separate decision by a named person. The wider reasoning is in regulated autonomy.
Where Pryme fits
In Pryme, the agent's role sets the ceiling, evidence from Attest sets the depth, and the lower wins. Certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day, whatever the ceiling. Raising a ceiling is a recorded change made by a named person.
Questions people ask
Can an agent ever exceed its ceiling?
No. The ceiling is enforced at the moment of action. A request above it is refused or held, and the verdict names the ceiling as the bound that decided.
Should every capability have the same ceiling?
No. Ceilings should follow the risk of each action. Reading records might have a ceiling of 3 while releasing payments stays at 2 for the life of the programme.