The Five Levels of Agent Autonomy (And How to Pick One)

Most discussion of AI autonomy treats it as binary: either a human approves things or the agent runs free. That framing makes the decision feel bigger than it is, and it's the reason so many people are stuck approving everything — the alternative sounds like abdication.

It isn't binary. There are five distinguishable rungs, the gaps between them are small, and the right one is a property of the task, not of how much you trust the tool.

The ladder

Level 1 — Suggest. The agent proposes; you do the thing. Useful when the action itself is trivial but the judgement isn't, and useful as a first week with any new task, because you see its reasoning without any of its mistakes reaching the world.

Level 2 — Approve each action. It prepares each step and waits. Genuinely safe, and it degrades faster than anything else on this list — approvals that arrive constantly get clicked rather than read, usually within a fortnight. Treat this as a temporary rung, not a resting place.

Level 3 — Act and report. It does the work and tells you what it did, in a form you can actually check. This is the rung most routine work belongs on and the one most people skip past, because moving to it feels like a bigger step than it is.

Level 4 — Act and log. It does the work, records it, and you look at a sample rather than each item. Appropriate for high-volume work where reviewing each item costs more than the errors do.

Level 5 — Act silently. No routine visibility at all. Almost nothing belongs here, and the honest reason it exists on the list is that plenty of tools have quietly put themselves on it without asking.

The two questions that pick the rung

Is it reversible, and how expensive is reversing it? A draft is free to undo. A sent email is not undoable at all — only apologised for. Money and deletion are their own category.

How would you find out it went wrong? This is the question nobody asks, and it's the one that matters more. Some errors announce themselves: the report is empty, the client replies confused. Others are silent — a categorisation drifting slowly wrong, a figure that's plausible and incorrect.

Silent failures need a lower rung than their reversibility suggests. An error you'd never notice can't be caught by any amount of trust.

Different rungs for different actions in the same task

The most common mistake is picking one level for a whole workflow. An agent handling inbound queries can reasonably be at level 4 for tagging and routing, level 3 for drafting replies, and level 2 for anything that sends externally or touches a refund.

Splitting like this is what makes the checkpoints survive. If the approval only fires on the handful of actions that genuinely need it, it still gets read a month later — which is the entire value of having it.

Moving up

The move is earned by evidence, not by time or comfort. Concretely: a period at the current rung with no surprises, and a specific written answer to how you'd detect the failure if it happened at the next one.

If you can't answer the second question, you're not ready to move — regardless of how well it's been doing. Confidence and detectability are different things, and only one of them protects you.

Moving down

Less discussed and more important. Move down when the inputs change — a new supplier, a new document format, a reorganisation, a new quarter with a different case mix.

Agent failures cluster after input changes, and the reason is unglamorous: it's still handling the situation it was validated on, and the situation has moved. A fortnight back at a lower rung after any material change costs little and catches the class of failure that produces the incident stories.

Sunil — the approvals he'd stopped reading

Sunil manages a finance operations team. An invoice-processing agent ran at level 2, requiring approval on every item, which he described as "the safe setting".

An audit found four incorrect coding decisions had been approved over two months. The approvals were arriving at around sixty a day; nobody was reading them by week two, and the checkpoint had become a formality that produced a record of human sign-off without any human judgement in it.

He split the task instead: level 4 for anything under a threshold with weekly sampling, level 2 for anything above it. Roughly six approvals a day now, and they get read.

Bea — the rung she moved down

Bea runs a small research consultancy. A source-screening agent had been at level 4 for months, sampled weekly, working well.

When a major publisher changed its site structure, she moved it back to level 3 for two weeks — not because she expected failure, but because the input had changed and the previous validation no longer applied.

It had in fact started silently skipping a category of source. At level 4 she'd have found that at the next weekly sample, in work already delivered.

The one thing

Autonomy is a ladder, not a switch, and the rung is a property of the task rather than of your trust in the tool.

Pick by reversibility and by whether the failure would be silent. Split a workflow across rungs so the checkpoints stay meaningful. And move down when the inputs change — that's where the failures actually live.