In 30 seconds

For any action, an AI can be prohibited from it, allowed to suggest it, allowed to draft it, or allowed to execute it. This is autonomy, and it is a separate question from whether the AI can technically reach the system.

Deciding autonomy action by action is one of the most useful things a specification can do.

The four levels

PROHIBITED   The AI may not perform this action at all.
SUGGEST      The AI may recommend the action; a person does it.
DRAFT        The AI may prepare the action for review.
EXECUTE      The AI may perform the action itself.

Each level gives the AI a little more responsibility, and takes a little more control away from the person. Choose the lowest level that still delivers the value.

Keep autonomy separate from access

A common muddle is treating access and autonomy as the same thing. They are not.

  • Access is about what the AI can technically reach: read or write.
  • Autonomy is about how far it may go on a given action: suggest, draft or execute.

An AI might have write access to a system but only be allowed to draft changes, not execute them. Keeping these two ideas separate prevents the confusion where "it can reach the system" is mistaken for "it may act on the system".

Choose the level per action, not per system

Different actions in the same workflow can sit at different levels. The same agent might execute a low-risk, reversible action, draft a consequential one, and be prohibited from a dangerous one entirely. Decide each action on its own, based on cost and reversibility.

A small example

An AI handling orders was set up per action: it could execute a stock check (read, safe), draft a customer confirmation (write, consequential, reviewed), and was prohibited from issuing refunds (high cost). One agent, three different autonomy levels, each matched to the action's risk.

What this does not solve

Setting autonomy levels defines how far the AI may go; it does not make each action correct or catch every bad case. Draft still needs a reviewer with time and context, and execute still needs logging and reversal. Autonomy is the boundary, not the whole safety system.