Autonomy levels sort what an agent may do into steps, from only reading to acting without a person. They work when each level is tied to a specific capability, granted on evidence and checked at the moment of action. They fail when a single level is stamped on a whole agent and then left alone.
What do the levels usually look like?
Most schemes run from "the agent only observes" to "the agent acts alone". Ours uses five depths, and each one describes what the agent may do with a single capability.
- Read. The agent can look things up and report. It changes nothing.
- Draft. The agent prepares the action, such as a letter or a journal entry, and a person sends or posts it.
- Execute routine work within bounds. The agent acts on its own for routine cases inside set limits, and passes the rest to a person.
- Move money or take actions that are hard to undo. Reserved for capabilities with strong evidence, tight limits and, often, a person releasing each action.
- Coordinate other agents. Only for orchestrators, and never a way to give a sub-agent more authority than it holds itself.
Other published schemes exist. The Cloud Security Alliance, for example, has published autonomy levels for AI agents running from 0 to 5. The labels differ, but the idea is the same: more autonomy means fewer points where a person checks the work. For a fuller definition, see what autonomy levels for AI agents are.
How is a level granted?
A level should be earned, not configured. Three inputs decide it.
- The ceiling. The organisation sets the maximum depth it will accept for each capability, often based on regulation, risk appetite and its plan.
- The evidence. The capability is tested by replaying the organisation's own past cases and scoring each answer. A capability that does well earns a higher depth; one that does badly stays low.
- The lower wins. If the evidence supports depth 3 but the ceiling is 2, the agent runs at 2. If the ceiling is 4 but the evidence supports 2, it runs at 2.
The grant should also expire. A level proven months ago on a process that has since changed is not proof now. Re-testing on a fixed cycle keeps the level honest.
How is a level enforced when the agent acts?
This is where many schemes stop short. A level written in a policy document does not stop an agent at runtime. Enforcement has to happen at the moment of action, every time.
When the agent tries to act, the platform checks the request against every bound that applies: the agent's role scope, its current certificate, the reliability of its sources, the organisation's own limits and the platform's fixed guardrails. The lowest bound wins. The result is one of four verdicts: allowed, held for a named person, refused, or withheld because the action is blocked for every agent. Each verdict is filed in a record that cannot be edited.
That makes the level a live control rather than a label. The idea of operating within enforced limits is explained in what bounded autonomy is.
What are the limits of autonomy levels?
Levels describe how much an agent does alone. They do not say whether it does it well. Two agents at the same level can differ greatly in accuracy, and a level applied to a whole agent hides which of its capabilities are trustworthy.
That is the argument in autonomy levels are not enough: certify the capability. A level means something only when it is attached to one capability, for one organisation, backed by evidence from that organisation's own cases. For the case for and against levels as a governance tool, see whether autonomy levels are the right way to govern AI agents.
Levels also do not settle reversibility on their own. A capability at depth 3 that sends external emails is riskier than one at depth 3 that updates internal tags. The level has to be read alongside what the action does, as argued in why autonomy in regulated industries is a question about reversal.
What stays with a person at every level?
- Setting the ceiling for each capability.
- Approving a change in level, up or down.
- Every action the platform holds.
- Irreversible actions, unless a person has explicitly placed them at depth 4 with limits and accepted the risk.
- Investigating any failure that drops a level.
A failed test should lower the level the same day. A level that can only rise is not a control.
Questions people ask
Does a higher level mean a better agent?
No. It means an agent with more evidence behind a specific capability, in a specific organisation. A well-built agent may sit at depth 2 for a capability that is irreversible, and that is the right setting.
Can one agent be at different levels at once?
Yes, and it usually should be. An agent may read at depth 1, draft letters at depth 2 and update records at depth 3, all at the same time.
Who sets the level?
The organisation sets the ceiling and the evidence sets the depth beneath it. A named person approves each change, and the record shows who and why.