Designing Autonomy Levels
An autonomy level defines how much automatic execution an AI agent is allowed. Rather than choosing between full delegation and full supervision, practical designs set the level per operation.
Two Axes for the Decision
The level follows from the nature of the operation.
| Axis | Question |
|---|---|
| Blast radius | On failure, who and what is affected |
| Reversibility | Can the previous state be restored, and at what cost |
graph TD
A["Small impact, reversible"] --> Auto["Safe to run automatically"]
B["Large impact, or irreversible"] --> Appr["Require approval before running"]Guidance by Operation
| Operation | Blast radius | Reversibility | Guidance |
|---|---|---|---|
| Search and read | Small | No effect | Automatic |
| Creating temporary files | Small | Reversible | Automatic |
| Modifying existing files | Medium | Reversible with history | Automatic, with the diff shown |
| External notification or sending | Large | Irreversible | Approval required |
| Applying changes to production | Large | Costly to undo | Approval required |
| Deleting data | Large | Irreversible | Approval required |
When the call is unclear, let reversibility decide. An operation that cannot be undone is worth gating even when its impact looks small.
Put Approval Immediately Before the Action
Placement changes the value of an approval. Collecting permission in bulk at the start means approving before anyone knows what will actually happen.
The most effective placement is immediately before an irreversible operation, showing concretely what is about to run.
Do Not Over-Ask
Excessive confirmation fails too. When every internal step requires approval, people stop reading and click through, and genuinely important approvals pass unexamined.
- Do not confirm read-only operations
- Grant same-kind operations in bulk within a defined scope
- When confirming, state in one or two lines exactly what will happen
Widen the Scope in Stages
Rather than granting broad permissions at once, widen them through these four stages while confirming results through evaluation.
- Suggest only — a human performs every action
- Approval-gated — read operations are automated; everything else requires approval before running
- Conditionally autonomous — reversible changes are automated with the diff shown; only irreversible operations require approval
- Autonomous — routine work only, run automatically to completion
Summary
- Set autonomy per operation, judged on blast radius and reversibility
- Gate irreversible operations even when their impact looks small
- Place approval immediately before the action, with concrete detail
- Automate read operations so confirmation does not become a formality