How much autonomy to give an AI agent isn't a yes-or-no question
The autonomy conversation almost always gets framed as a switch: either the agent does things on its own, or it doesn't. Framed that way there are only two endings, and both of them are bad. The first is leaving it in suggestion mode forever, where nobody has any skin in the game: the person still does the whole job, now with one extra opinion on the table, and the system saves not one real hour. The second is turning it fully loose on day one because the demo went well, and finding out about the failure when it is already sitting in a customer's inbox.
Autonomy isn't a switch. It's a ladder. And like any ladder, you climb one rung at a time, and only once the one below holds your weight. What follows is the five rungs, the three criteria that authorise a climb, and the short list of actions that stay halfway up by design. If what you're deciding is still what the agent gets to touch, that decision comes earlier and it's settled in what permissions to give an AI agent: permissions define the reach, autonomy defines the speed. They are not the same thing and they get decided separately.
The five rungs, one by one
The rungs are ordered by two questions: who executes and who reviews. Not by how clever the model is.
Rung 1 — Watches in shadow
The agent gets the real cases, does the whole job, and its output reaches nobody: it stays in the log. Operations never finds out it exists. It's the only rung where being wrong is free, and that is exactly why it's the only place you can afford to discover what the system can't do.
What you measure here isn't "does it get it right", it's what you compare it against. In shadow you need to keep the human decision on the same case so you can put the two side by side. If you only store the agent's output, at the end of the month you will have a thousand answers and no way of knowing whether any of them were good. This is the rung people skip most — it ships nothing visible, so it looks like wasted time — and the most expensive one to skip: without it, the first real measurement of your system gets taken by a customer.
Rung 2 — Suggests
Its output reaches the person as a proposal. The person still does the job; what the agent takes away is the blank page. The saving is real but modest, and that's the point: this is a learning rung, not a return rung. Its value is that the first number that actually matters shows up here — the correction rate — and it shows up free, because the person was going to review anyway.
The classic rung-2 mistake is moving in. A system that has been suggesting for eight months isn't being prudent: it's a system nobody dares to evaluate. If the numbers support a climb and nobody climbs, what's missing isn't evidence. It's somebody willing to sign.
Rung 3 — Executes on confirmation
The agent leaves the action prepared and complete — the email written, the entry balanced, the ticket classified and routed — and a person hits the button. This is the pattern the literature calls human in the loop, and the difference from rung 2 is who carries the work: on rung 2 the person executes, on rung 3 the person reviews. That shift is where the first saving anyone notices in the hours ledger shows up.
Warning: rung 3 decays on its own. When confirmation is one click across twenty identical items, it stops being oversight and becomes paperwork. If your rejection rate drops to zero, don't celebrate: check whether the system got better or the reviewer stopped reading. The shape of that oversight and its mechanics are worked out in human in the loop in an AI automation; what matters isn't that somebody is watching, it's that they have context, time and real authority to say no.
Rung 4 — Executes and notifies
The agent acts and leaves the notice. The person no longer authorises: they watch. This is what gets called human on the loop. The rung only makes sense if a real reversal window exists: a stretch of time in which the action can be undone without it having cost anybody anything. A draft that goes out in ten minutes and can be cancelled has a window. An invoice already issued does not.
What you have to design here isn't the notification — that's the easy part — it's the undo. If the reversal plan is "we call the customer and apologise", you don't have a rung 4: you have a rung 5 in disguise, with the accountability spread across nobody.
Rung 5 — Executes and accounts for it
The agent acts and nobody looks case by case. What gets reviewed is the aggregate: a weekly sample, the usual metrics, and the exceptions the system raises on its own. It is not the absence of oversight, it is statistical oversight — and it only works if the system knows how to declare when it isn't sure. An agent with no way of saying "I'm not confident about this one" cannot sit on rung 5, because its errors arrive wearing the same face as its hits.
Very few tasks get here, and the ones that do share a profile: high volume, cheap error, fast correction. Classifying, routing, tagging, pulling fields out of a document so another system can validate them. When the volume of what needs reviewing stops fitting inside one person, oversight becomes a function with a process of its own, and that is already human oversight of AI at scale.
The three criteria for climbing a rung ("it's going well" is not one of them)
A rung gets climbed on evidence, and the evidence is three numbers that all have to be in your favour at the same time. Two out of three authorises nothing.
1. Volume of cases seen
Twenty cases tell you nothing: they tell you the agent works on the twenty cases it happened to get. What you need isn't a magic number, it's having seen the weird ones: the customer who writes in two languages, the invoice with no PO number, month-end close, the supplier who replies with a PDF scanned upside down. A practical rule: if you can't name three weird cases the agent has already handled well, you're still measuring the easy ones.
2. Human correction rate — and its shape
The share of times the person changed what the agent proposed. But the number on its own, without its shape, lies to you. Ten per cent of corrections scattered at random is tolerable noise. Ten per cent always concentrated on the same kind of case is a known hole the average is hiding from you, and climbing a rung with that hole open is automating precisely the failure. Before you look at the percentage, group the corrections by reason; if one reason takes more than half of them, that reason is the work outstanding, not the climb.
3. Reversibility of the action
Three questions, in this order: can it be undone? what does undoing it cost? how long have you got before it's too late? An unsent draft is reversible and free. An email already with a customer is half reversible and expensive: you fix it with another email and an uncomfortable conversation. An executed wire transfer is not reversible — it is a second transfer in the opposite direction, with a call to the bank in the middle and a fair chance the money never comes back.
This criterion doesn't trade against the other two. If the action can't be undone, it makes no difference that the correction rate is 0.1% across a hundred thousand cases: the climb is not authorised. Precision cuts how often the error happens. It doesn't cut what the error costs.
What stays on rung 3 forever
Some actions do not climb even when all three criteria are spotless. It is not distrust of the model: it is that the model does not pay the cost of the first percentile. Three families:
- Money going out. Payments, transfers, refunds, onboarding a supplier with a new bank account. Invoice-redirection fraud works precisely because plenty of people automated this step before they should have.
- People. Hiring, pay, discipline, evaluation, any decision that touches somebody's employment. Here the legal exposure piles on by itself, and it doesn't wait for an AI statute to do it.
- Commitments to third parties. Contracts, firm offers, locked prices, promised deadlines, and any communication with a government body. What goes out the door with your name on it gets signed by a person.
This three-family list is ours, not a regulator's. But the regulator points in the same direction: the Spanish data protection authority — which has no jurisdiction over a US company — sets out the four-eyes principle, double-checking by two different people, and raises it for automated processes with a major impact on people's rights and freedoms. That criterion is broader and more abstract than our three families; what we do here is land it on the concrete actions where, in a normal company, the mistake does not get undone with a click.
What you are actually on the hook for, and what no rulebook decides for you
In the United States there is no federal statute that tells you how autonomous an agent is allowed to be, and none that requires a human to confirm before it acts. The closest thing to a shared reference is the NIST AI Risk Management Framework (NIST AI 100-1, published January 2023): voluntary, not law, and built around four functions — govern, map, measure and manage. What it gives you is a vocabulary your board and your customers' procurement teams already recognise, plus a structure for writing down how you decide. What it does not give you is a rung. Source: AI Risk Management Framework, NIST.
One European text does bind you the moment you sell into or deploy in the EU market: the AI Act makes human oversight an obligation for high-risk systems in its article 14. The system has to be designed so that natural persons can effectively oversee it while it is in use, understanding its capabilities and limitations, detecting anomalies and unexpected behaviour, and intervening or stopping it. Translated into the ladder: on every rung, rung 5 included, somebody has to be able to understand, intervene and stop. A kill switch nobody has ever tested does not satisfy article 14; it satisfies the minutes of the meeting. Alongside it, and binding on nobody outside its own jurisdiction, in February 2026 the Spanish data protection authority published the clearest guidance a European regulator has put out on agents so far, written from a data protection angle: governance of the system, involvement of the data protection officer, continuous evaluation of the agent's performance, memory compartmentalisation, traceability of the data lifecycle, meaningful human oversight, technically isolated environments and strict control of updates. Worth reading even where it does not apply to you, because it spells out in operational terms what "supervised" actually has to mean. Source: Guidance on agentic artificial intelligence, AEPD, version 1.2, February 2026.
And now what none of them does: hand you the ladder. A voluntary framework tells you to govern and to document. A regulation tells you what you have to be capable of, and which operations need two pairs of eyes. Which rung each task sits on is your call, and that is exactly why it has to be written down somewhere instead of living in the head of whoever built the system. The five rungs in this guide are an editorial formulation of ours, not an official classification: use them, change them or invent your own — but have them in writing. Where they get written is the document that governs the agent, and it has an anatomy of its own: the instructions of an AI agent.
The three mistakes that keep repeating on the way up
Climbing by calendar
"We have been on suggest for a month, time to move up." Time is evidence of nothing: a slow month is forty cases and a busy one is four hundred. What authorises the climb is the volume of cases seen, not the weeks elapsed.
Mistaking "it hasn't broken" for "it's going well"
The absence of complaints is not a metric. On rungs 2 and 3 the person absorbs the agent's errors in silence, so a system can spend months being mediocre without anybody saying so. If you aren't measuring correction, you don't have evidence: you have an absence of noise.
Climbing the whole agent
The most expensive mistake and the most common one. An agent does five things and only two have the numbers to move up; the agent gets moved and the other three ride along for free. The climb is authorised per action, logged per action and rolled back per action. The idea of an agent that "is autonomous now" is the same one taken apart in the myth of the 100% autonomous agent: in production there is no switch, there is a split.
How this gets written down on a one-page table
This whole guide fits in a table you review once a month. One row per action, not per agent:
| Action | Rung today | What is missing to climb | Who authorises |
|---|---|---|---|
| Classify and route inbound email | 4 — executes and notifies | Weekly sample, 3 months with no drift by type | Head of operations |
| Draft the reply to the customer | 3 — executes on confirmation | Correction under 8% and scattered by reason | Head of support |
| Issue the invoice | 3 — permanent ceiling | Doesn't climb: money going out | — |
| Extract fields from a delivery note | 5 — accounts for it | Already up there; review the exceptions | Head of administration |
- One row per action. If a row says "the support agent", it is badly written: split it.
- Today's rung, with a date. Without a date you won't know whether it has been sitting there three weeks or seven months.
- What is missing to climb, as a number. "When we feel comfortable" is not a criterion; "correction under 8% and scattered" is.
- One name that authorises. A person, not a committee. If nobody signs, nothing climbs and the system sits on rung 2 forever.
- Flag the rows with a permanent ceiling. Money, people and commitments to third parties carry "does not climb" in writing, so that a year from now nobody has to reopen the argument.
We build agents that start in shadow and climb with this table in front of them — that's what the AI employees we put to work do, running on the infrastructure that lets you stop them and audit them the day you need to, inside the general logic of building an AI agent that survives production. We don't sell autonomy. We charge for every rung being climbed with a number and a name behind it.