Autonomy Levels

The ladder.

Borrowed in spirit from the driving-automation levels everyone knows, adapted to LLM agents. The variable that changes between levels is exactly one thing: who decides, and who has to approve, the next action.

L0  SUGGEST       Model proposes; human does everything.
                  "Here's a draft email." You read, edit, send.
                  No tools fire. This is a chatbot.

L1  ACT-WITH-     Model proposes a specific action; human must
    APPROVAL      approve before it executes.
                  "I want to run: DELETE FROM logs WHERE ... .
                   Approve? [y/N]"  Nothing happens on its own.

L2  ACT-AND-      Model acts autonomously on low-stakes steps;
    ESCALATE      pauses for approval on flagged high-stakes ones.
                  Reads files freely; asks before it emails a
                  customer or spends money.

L3  SUPERVISED    Model runs the whole loop unattended; a human
    AUTONOMY      reviews the result and can intervene/roll back.
                  "It refactored the module overnight; review
                   the PR in the morning."

L4  FULL          Model runs the loop and the outcome takes
    AUTONOMY      effect with no human in the path at all.
                  Production triage bot that closes tickets
                  itself, 24/7, no review queue.

Two clarifications people always need. First, the level is a property of a specific task within a system, not the whole product — a coding agent might be L3 for writing tests but L1 for touching the deploy pipeline. Second, higher is not better. L4 is not the "mature" version of L1; it is a different risk posture you adopt only when the task warrants it.

What actually changes as you climb.

Each rung up the ladder trades human effort for two things you must consciously accept: more blast radius and less recoverability.

• Throughput goes up. The entire economic argument for autonomy is here: a human approving every step is the bottleneck. Remove the human and the agent runs at machine speed across thousands of tasks. This is real and is why anyone bothers.
• The cost of a single bad decision goes up. At L1, a wrong action is caught at the approval prompt — annoying, harmless. At L4, the same wrong action executes against production before anyone sees it. The model's error rate didn't change; the consequence of each error did.
• Errors compound silently. At low autonomy, a human breaks error cascades by noticing "that doesn't look right" early. At high autonomy, a wrong observation feeds a wrong decision feeds a worse observation, and the loop amplifies its own mistake with no circuit breaker. Autonomy doesn't just raise the stakes per action — it removes the thing that catches cascades.
• You stop being able to explain what happened in real time. A supervised agent's trace is reviewed after the fact. By then the actions already happened. "We can audit the logs" is true and is not the same as "we can prevent the bad outcome."

Choosing the level: two questions, in order.

Do not pick an autonomy level by ambition. Pick it by answering two questions about the task, in this order:

• Question 1 — Reversibility. "If the agent does the wrong thing here, can I cheaply undo it?" Drafting text: fully reversible, you just don't send it. Opening a pull request: reversible, it's just a proposal. Sending money, emailing a customer, dropping a database table, merging to main and auto-deploying: not cheaply reversible. Irreversible actions cap your autonomy at L1–L2 regardless of how good the model is. This is the dominant factor.
• Question 2 — Frequency and oversight capacity. "How often does this run, and can a human realistically keep up?" A task that runs ten times a day can sustain L1 human approval. A task that runs ten thousand times a day cannot — there is no human bandwidth, so you are forced toward L2/L3 with sampling and guardrails, and you must therefore restrict the task to reversible actions (back to Question 1).

Worked example: an agent that triages incoming support tickets. Classifying and tagging a ticket is reversible and high-frequency → L3/L4 is fine. Issuing a refund is not cheaply reversible → that specific action stays at L1 (human approves each refund) even though it lives inside the same agent. The lesson, again: set autonomy per action, not per agent.

The human-in-the-loop dial is the same dial.

You will hear "human in the loop", "human on the loop", and "human out of the loop". These are not a separate concept — they are just names for positions on this same ladder, described from the human's seat instead of the agent's:

• Human in the loop = L1: a human is a required step inside the loop; the agent cannot proceed without them. Maximum control, minimum throughput.
• Human on the loop = L2/L3: the loop runs on its own; a human monitors and can interrupt or override. Control is a veto, not a gate.
• Human out of the loop = L4: the human is not in the execution path at all; oversight, if any, is statistical and after the fact.

The single most useful habit this gives you: whenever someone describes an "AI agent", ask "what's the autonomy level, per action, and what makes the risky actions reversible?" If they can't answer crisply, the system has not been designed — it has been hoped into existence. Autonomy is the variable that turns a helpful tool into a liability, and it is the one you, the designer, control most directly. The remaining entries — tools and environments, when to use an agent, the risks — are in large part a study of how to set this dial responsibly.