Most conversations about AI agents ask whether the agent is good enough. A more useful question for an operations lead is narrower: for this process, what is the agent allowed to do without asking? The answer will differ from one process to the next, and it should be a decision someone made, not a setting nobody looked at.
This article gives a simple scale, a way to choose a level for each process, and a one-page record. It is about autonomy, meaning who acts. For the related question of what a person signs off and what gets logged, see human approval and audit trails for AI agents.
Why one setting for the whole agent does not work
It is tempting to describe an agent as "autonomous" or "supervised". In practice a single agent usually touches several processes at once: drafting replies, updating records, booking appointments, sending documents. These carry very different risks. Drafting an internal summary and sending a refund confirmation to a customer are not the same kind of act, even if the same agent does both.
So attach the level to the process. The agent is the tool; the process is what you are managing.
Three levels
Keep the scale short. Three levels are enough for most companies, and people actually remember them.
Level 1 - Suggest. The agent prepares a draft, a recommendation or a proposed action. A person reads it and does the action themselves. Nothing leaves the building and nothing changes in a system because of the agent alone.
Level 2 - Act after approval. The agent prepares the action and carries it out, but only after a named person approves that specific action. The approval is a real gate: without it, nothing happens.
Level 3 - Act and report. The agent carries out the action on its own and records what it did. A person sees a report afterwards, can review a sample or the exceptions, and can undo or correct what went wrong.
Some teams add a Level 0, "off", for processes where the agent should not be involved at all. That is worth writing down too, because it prevents quiet scope creep.
How to choose a level
Do not choose by how impressive the agent looks in a demo. Ask three questions about the process itself.
- What does a mistake cost? Think of money, time, a customer relationship, a compliance problem. A wrong internal tag costs little; a wrong figure in a quote costs more.
- Can it be undone? An edit to a draft can be reverted. An email that has been sent, a payment that has been released or a record shared outside the company often cannot be taken back.
- Who is affected? An error that only touches your own team is different from one that reaches a customer, a supplier or a regulator.
A rough reading follows from the answers:
- Low cost, easy to undo, internal audience: Level 3 is a reasonable candidate, once the agent has shown it handles the process well.
- Moderate cost or partly reversible, or the audience is external: Level 2.
- High cost, hard to undo, or anything that commits the company to something: Level 1, or Level 2 with a senior approver.
Treat these as starting points for a conversation, not a formula. If the answers disagree, take the more cautious level.
Start low and earn the next level
Every process begins at the lowest level that is still useful. For many processes that is Level 1: the agent suggests, the person acts. This costs a little speed and gives you something valuable, which is evidence. While people review suggestions, you learn how often they accept them unchanged, how often they edit them and how often they reject them.
Moving up should be a decision, not a drift. A reasonable rule is that a process moves from Level 1 to Level 2, or from Level 2 to Level 3, only when:
- a named owner proposes the change and writes down the reason;
- the evidence comes from real use of this process, not from general trust in the tool;
- the owner has checked that the undo route and the report actually work;
- the change takes effect on a stated date, so everyone knows which rules apply.
Do not infer approval from silence. If nobody objects to an agent doing something, that is not a decision.
Guardrails that belong to every level
Autonomy levels work only if some limits hold regardless of the level.
- Scope. The level applies to the listed actions only. A new kind of action is a new line in the register, starting at the lowest useful level.
- Access. The agent's permissions should not exceed its highest assigned level. If it can technically do more than you have allowed, the written level is not the real level.
- Stop. Someone must be able to pause the agent quickly. See incident response and kill switches for AI agents for how to prepare that.
- Unusual cases. Define triggers that push a Level 3 action back to a person: an unusual amount, a customer who has complained before, missing data, a request the agent has not seen. When the agent is unsure, the sensible default is to ask.
Review and step down
Levels are not permanent. Set a review date for each process; quarterly is a common starting rhythm, and a shorter one makes sense for new or sensitive processes. At the review, the owner looks at what actually happened: errors, corrections, complaints, exceptions, anything the agent did that surprised people.
Also agree in advance what moves a process down. A serious error at Level 3 should send the process back to Level 2 until the cause is understood and fixed. Stepping down is not a punishment for the agent. It is the normal way to keep trust matched to evidence.
Review the levels as well when something around the process changes: a new model version, a new vendor, new data sources, a new product or a change in your own rules. A level was chosen under certain conditions, and those conditions may no longer hold.
Write it down on one page
A level that exists only in people's heads will be remembered differently by each of them. Keep a short register, one row per process:
| Field | What to write |
|---|---|
| Process | A plain name, for example "first reply to support requests" |
| Allowed actions | The specific things the agent may do |
| Level | 0, 1, 2 or 3 |
| Owner | The person who decides and answers for this level |
| Approver | For Level 2, who approves, and who covers when they are away |
| Reason | One or two sentences on cost, reversibility and who is affected |
| Triggers | What sends a case back to a person |
| Next review | A date, not "regularly" |
Share the register with everyone who works with the agent. When an employee asks "can it just do this?", the answer should be a row in the register, not an opinion.
A short checklist
- Every process the agent touches has its own level, including "off" where that applies.
- Each level was chosen from cost of error, reversibility and who is affected.
- New processes start at the lowest useful level.
- Moving up needs a named owner, a reason and evidence from real use.
- Permissions in the system match the written level.
- Triggers send unusual cases to a person, and someone can stop the agent quickly.
- Each row has an owner and a review date, and a serious error moves the process down.
The aim is not to hold the agent back. It is to make sure that when it acts alone, someone decided that it should, knows why, and will notice if the decision stops being right. If you are also setting up your first deployment, the questions in legal questions to settle before launching an AI agent pair well with this register.
