A customer ceiling is the highest depth a customer permits an AI agent to reach for a given capability, set through the customer's plan and its own policy. Certification evidence can earn the agent depth up to the ceiling but never past it. The ceiling caps depth, the evidence sets it, and the lower of the two applies.
Why does a customer ceiling matter?
Evidence answers whether an agent can do something reliably. It does not answer whether the business wants it to. A bank may have an agent that handles payment releases perfectly on every test case and still decide, as a matter of risk appetite or regulatory expectation, that payment releases stay drafted for a person. The customer ceiling is where that decision is written down.
Without a ceiling, strong evidence would carry an agent's depth upward automatically. With one, the business keeps the last word on how far automation goes in each capability, independent of how good the agent becomes. That separation of proof from permission is central to agent governance is a bound, not a model.
How does it work in practice?
The ceiling is set per capability, not per agent. A single support agent might have:
| Capability | Customer ceiling | Earned depth | Depth in use |
|---|---|---|---|
| Answer account questions | 1 (read) | 1 | 1 |
| Update contact details | 3 (execute) | 3 | 3 |
| Issue refunds | 2 (draft) | 4 | 2 |
| Close accounts | 2 (draft) | 2 | 2 |
The refund row shows the ceiling at work. The agent has earned depth 4 for refunds, but the customer has capped it at 2, so refunds are drafted and a person sends them. If the customer later raises the ceiling, the agent can act at the depth its evidence supports, provided its certificate is still in date.
Choosing a starting point is covered in setting the first ceiling for a new agent.
What does that look like in an example?
A building society deploys a mortgage servicing agent. Certification shows the agent handles overpayment requests accurately at depth 3. The society's risk committee sets the customer ceiling for overpayments at 2 for the first quarter, so every overpayment is drafted and approved by a person. After three months of approvals with no corrections, the committee raises the ceiling to 3. The agent's depth for that capability rises the same day, because the evidence was already there.
How is a customer ceiling different from the customer's limits?
Both are set by the customer, but they act on different things. The ceiling caps depth for a whole capability: whether the agent may draft, execute or move money at all. The customer's limits act on individual actions within that depth: amounts, counterparties, hours, daily volumes. An agent at depth 4 for refunds might still have a limit of 200 per refund, above which each refund is held.
A customer ceiling is one form of autonomy ceiling, the general idea of a cap on how far an agent may act. What makes it a customer ceiling is ownership: the customer sets it, and only the customer can raise it. The platform floor is different again, since it withholds certain actions for every customer.
Which related terms should you know?
- Bound: one of the five limits every action meets; the customer ceiling feeds the certificate and limit bounds.
- Earned depth: the depth evidence supports, before the ceiling applies.
- Platform floor: actions withheld for every agent, which no ceiling can reach.
Questions people ask
Can a customer ceiling be higher than what the agent has earned?
Yes, and it often is. The ceiling is a maximum, not a target. If the agent has only earned depth 2, it works at depth 2 even if the ceiling is 4, until certification shows more.
Who in the business should set the customer ceiling?
The person accountable for the outcome in that area, such as the head of operations or a risk committee, not the team that built the agent. Each change should be recorded with who made it and why, so it can be read alongside the agent's verdicts.