Bounded autonomy is an arrangement in which an AI agent acts on its own, without step-by-step approval, but only inside limits that are set in advance and enforced outside the agent: which actions, up to what amounts, on what evidence, for which customers. Inside the bounds the agent proceeds. At the edge, the action is held for a person or refused.
Why does bounded autonomy matter once agents act?
Because it is the only form of autonomy a regulated business can defend. "We let the agent decide" is not an answer a supervisor accepts. "The agent may agree standard payment plans up to these terms, on these records, and anything else goes to a named person" is. The bounds turn autonomy from a matter of trust into a matter of record.
They also make the agent useful. Without bounds, the safe choice is to approve every step, which wastes the agent. With clear bounds, routine work flows and only the exceptions wait.
What are the bounds, and how do they combine?
In our model, every action meets five bounds at once, which we call the minimum chain:
- Role scope: is the action part of this agent's job?
- Certificate: has the agent proven this capability, at this depth, on the customer's own cases?
- Sources: are the facts behind the action strong enough to support it?
- The customer's own limits: amounts, counterparties, times, products.
- Platform guardrails: actions no agent may take at any depth.
The lowest bound wins, and the verdict names which bound decided. An agent with a strong certificate is still stopped by a low customer limit; a generous limit does not help an agent whose facts are weak. Mapping actions to the bounds that should govern them is easier with an autonomy decision matrix.
What does that look like in an example?
A utility's billing agent may apply goodwill credits on its own. Its role covers credits for service failures. It is certified for that capability at depth 3. The utility's limit is 50 per account per year. The supporting fact, an outage record, must come from the network system, not the customer's message. A customer reports an outage and asks for 30. The outage is in the network record, the amount is within the limit, and the credit is applied. Another asks for 80. The customer limit is the lowest bound, so the credit is held for a team leader, and the verdict says so.
How is bounded autonomy different from supervised autonomy?
Supervised autonomy means the agent acts while a person watches and can intervene, in real time or soon after. Bounded autonomy means the limits are enforced at the moment of action, whether anyone is watching or not. Supervision depends on attention; bounds do not. In practice you want both: bounds that stop what must never happen, and supervision that catches what the bounds did not foresee.
How do bounds change over time?
As evidence builds, bounds can widen, which is the idea behind graduated autonomy. Widening should be a recorded decision, made through an autonomy change request, not a setting someone edits. How bounds interact with autonomy scales is covered in how autonomy levels for AI agents work, and the underlying principle in regulated autonomy.
Questions people ask
Can an agent change its own bounds?
No. Bounds are set by people and enforced by the platform. An agent may draft a proposal to widen them, but approval stays with a named person.
What happens when a bound blocks an action?
The verdict is held, refused or withheld, depending on which bound decided and why, and it is filed. A held action goes to a named person with the reason attached.