An autonomy level tells you how independently an agent is designed to act. It does not tell you whether it can do your work well enough to be trusted with it. Published levels describe an agent in general; certification proves the agent, on your own cases, before it may act. You need the second to make the first mean anything.
What do autonomy levels describe?
Autonomy levels for AI agents are a way of describing how much an agent does without a person. The Cloud Security Alliance, for example, has published a scale of autonomy levels for AI agents running from 0 to 5. Scales like this are useful. They give buyers, builders and risk teams a shared vocabulary, and they make it easier to compare how different agents are intended to operate.
How the levels are used in practice is explained in how autonomy levels for AI agents work. The important thing here is what they are: a description of design intent. A level answers "how independent is this agent meant to be?". It does not answer "should this agent be that independent, doing this task, in this firm?".
Why is a level not evidence?
Three gaps separate a published level from a decision you can defend.
A level is per agent; risk is per action. One agent may answer balance queries, block cards and issue refunds. Those carry very different risks. A single level for the whole agent, with no depth for each action, either over-trusts the risky capability or under-uses the safe ones.
A level is general; your work is specific. An agent may perform well on a vendor's test suite and poorly on your products, your customers and your edge cases. Your refund policy, your fee schedule and your vulnerable customers are not in anyone else's test set.
A level is static; performance drifts. Models change, sources change, policies change. A level assigned at launch says nothing about how the agent behaves six months later.
None of this makes levels useless. It makes them insufficient on their own as the basis for letting an agent act.
What does certification add?
Certification fills each gap directly.
| Gap | Autonomy level | Certification |
|---|---|---|
| Unit of trust | The whole agent | The agent, at one depth, and the depth each action needs |
| Evidence | Design intent, vendor testing | Replay against real cases from your own operation |
| Pass criteria | Not defined by the level | A floor per gate, each of which must clear on its own |
| Who it applies to | Everyone using the agent | Your firm, on your work |
| Duration | Indefinite | Lapses and must be renewed |
The process for an agent with a single capability is in how to certify an AI agent with a single capability, and the general method in how you certify an AI agent.
How do levels and certification fit together?
They answer different questions and can be used together. A level describes the architecture: whether the agent is built to read, draft, execute or coordinate. Certification decides, per agent, how much of that design you will actually permit, based on evidence.
A useful way to hold both: the level is a ceiling on what the agent could do; your own limits set a ceiling on what you will allow; certification sets the depth the agent has earned, and each action needs its own depth. The lowest wins. An agent designed for high autonomy, under limits that allow execution, certified only to drafting, drafts refunds.
Third-party standards sit alongside this. AIUC-1 is a third-party standard for AI agents from the Artificial Intelligence Underwriting Company. How standards of that kind, autonomy levels and certification relate is set out in AIUC-1, autonomy levels and certification: how they fit.
What does this look like on one agent?
Take an illustrative customer service agent at a mid-sized bank. Its vendor describes it as designed for high autonomy. The bank's own limits allow execution for routine work.
Certified on the bank's own cases, its work comes out differently. Answering balance and statement questions clears every gate. Freezing cards clears. Refunding fees clears most gates but falls below the floor on the refusal gate, because it sometimes refunds fees the policy excludes. Changing contact details clears accuracy but fails escalation on cases with signs of account takeover. The agent is certified to the highest depth its evidence cleared, and each action is checked against the depth it needs.
One agent, one design level, one certified depth, and a record of which cases held it back. That is the information the bank needs to deploy it, and no autonomy level could have given it.
What should you do with the levels you are given?
Use published levels to understand an agent's design and to compare products. Do not use them to decide what an agent may do in your firm. For that, certify the agent on your own cases against floors you set, covering each capability it will use, grant the depth that evidence supports, and let certificates lapse so the evidence stays current. The topic guide what it means to certify an agent sets out the full approach.
Where Pryme fits
Attest certifies each agent for each customer, by replaying it against real cases from that customer's operation and scoring every answer against a floor across seven gates: grounded, refuses, depth, escalates, scope, adversarial and stable. Each gate must clear on its own. Certificates lapse after 90 days; a lapse, or a run that clears no depth, drops the agent to depth 1 the same day.
Questions people ask
Are autonomy levels and depth the same thing?
They are related but not the same. Levels usually describe an agent as a whole; depth is certified per agent, per customer, on evidence, and each action needs a depth of its own.
Can a vendor's autonomy level be trusted?
It can be trusted as a description of what the agent is designed to do. It is not a statement about how well it does your work, which only your own cases can show.
Do we need certification for read-only agents?
Yes, though the cases can be lighter. A read-only agent that gives customers wrong answers still causes harm, and grounded and scope gates apply to it.