As autonomous as the evidence for each capability supports, and never further than you can reverse. Autonomy is not one setting for a whole agent. The same agent may read freely, draft letters for a person to send, run routine updates within limits, and still need approval for anything that moves money or cannot be undone.
Why set autonomy per capability, not per agent?
An agent is a bundle of capabilities. A customer service agent might look up an order, explain a policy, change a delivery address, issue a refund and close an account. Those actions carry very different risks. Giving the agent one autonomy setting forces you to choose between trusting it with the riskiest action or blocking it from the safest.
Setting autonomy per capability removes that false choice. The agent can change addresses on its own because it has proven it does so accurately, while refunds above a small amount still wait for a person. Each capability earns its own room. This is the basis of the argument in why autonomy in regulated industries is a question about reversal.
What does that look like for one agent?
We describe autonomy as depth, from 1 to 5. Here is an accounts payable agent at a mid-sized distributor, with each capability set separately.
| Capability | Depth | What that means |
|---|---|---|
| Read invoices, purchase orders and supplier records | 1 | Reads only |
| Answer supplier queries about payment status | 2 | Drafts replies; a person sends them |
| Match invoices to purchase orders and receipts | 3 | Executes within tolerance; mismatches go to a person |
| Post matched invoices to the ledger | 3 | Executes routine postings within limits |
| Change a supplier's bank details | 2 | Drafts the change; a person verifies by call-back and approves |
| Release a payment run | 4, held | Prepares the run; a named person releases it |
| Coordinate other finance agents | 5 | Not granted; this agent is not an orchestrator |
The same agent is at four different depths. That is the normal state of a well-governed agent, not a compromise.
What limits apply, whatever the evidence says?
Evidence can raise a capability's depth, but some limits hold regardless.
- Reversibility. If an action cannot be undone or offset, it waits for a person. No amount of evidence makes an irreversible mistake cheap.
- The customer's own ceiling. The organisation sets the maximum depth for each capability. Evidence cannot exceed it.
- Source quality. An action based on a fact from an unverified outside source should not run unattended, however good the agent is.
- Legal effect. Decisions with legal or similarly significant effects on a person, such as declining credit, carry rules of their own under GDPR Article 22 and its UK equivalent.
- Expiry. Proof is not permanent. Processes change, sources drift and models are updated, so authority should lapse unless it is renewed.
How should autonomy change over time?
Start low and raise one capability at a time. A new capability begins at depth 1 or 2, where the agent's work is visible and a person acts on it. Once it has been tested against your own past cases, and has run in draft alongside people long enough to compare outcomes, it can move up.
It should also move down. A failed test, a spike in overrides, a change to the process or a new source are all reasons to drop a capability back until it is proven again. Autonomy that can only go up is not governed.
For the vocabulary behind this, see what an autonomous agent is and what a semi-autonomous agent is. Most agents in regulated work are semi-autonomous by design.
What stays with a person?
Some things stay with a person at every depth:
- payments to new recipients and payments above the organisation's limit;
- decisions with legal or similarly significant effects on a customer;
- actions that disclose data outside the organisation;
- anything the agent flags as uncertain or outside its scope;
- the decision to raise or lower an agent's autonomy.
The last item matters most. The people who own the process decide how much room the agent gets, based on evidence they can read. An agent should never widen its own scope.
Where Pryme fits
In Pryme, depth is certified per agent, per customer. The agent's role sets a ceiling, Attest evidence from the customer's own cases sets the depth, and the lower wins. Certificates lapse after 90 days and a run that clears no depth drops the agent to depth 1 the same day, so autonomy moves down as readily as it moves up.
Questions people ask
Is more autonomy always the goal?
No. The goal is the right autonomy for each capability. A capability held at depth 2 permanently, because the action is irreversible, is a success, not a failure to progress.
Should agents ever be fully autonomous?
Individual capabilities can run without a person. A whole agent with every capability unattended is a different matter; see whether AI agents should be fully autonomous and what a fully autonomous agent needs before it can be trusted.
How do I explain this to a regulator or auditor?
Show them the capability list, the depth of each, the evidence that supports it and the record of every action. A per-capability view is easier to defend than a single autonomy label, because it answers the question an auditor actually asks: what could this agent do on its own, and why?