I run several AI agents against live systems. One of them operates with no human in the loop at all. Another cannot take certain actions without an explicit confirmation, even when it is confident. A third holds different capabilities depending on who is talking to it. None of those settings reflect how much I trust the model. They all fall out of one question, asked before any agent gets any permission: what is the worst thing this permission allows?
Autonomy is a property of the permission, not the model
Most debates about agent autonomy argue about the wrong variable. How capable is the model, how good is the prompt, how reliable is the planning. Those matter, but they are the wrong place to set the dial, because they all describe how likely the agent is to do the wrong thing. The dial should be set by what the wrong thing costs.
A perfectly reliable agent with dangerous permissions is one bug, one prompt injection, or one compromised dependency away from an incident. An unreliable agent whose worst possible action is trivially reversible is, at worst, annoying. Blast radius, not accuracy, is the variable that should decide how much supervision an agent needs.
Three of my agents, three settings
Full autonomy. My operational triage pipeline reads a stream of log signals, classifies them with the Claude API, and opens tickets, with no human review anywhere. That is not confidence in the model. Its only write permission is ticket creation. Enumerate the failure modes: a missed signal, a duplicate ticket, a wrong classification. Every one of them is noise, and noise is cheap. Adding a human reviewer would cost more than every failure the reviewer could prevent.
Confirmation at the point of irreversibility. My community agent acts freely where actions can be undone and stops for explicit confirmation where they cannot. The line is not drawn around categories of task, it is drawn around reversibility. Autonomy where mistakes are cheap, friction exactly where they are not.
Brokered access with bounded reach. My chief-of-staff agent works across the systems my day runs on, which makes its theoretical blast radius the largest of the three. So it holds no raw credentials at all; a broker mediates every secret, egress is bounded to declared destinations, and changes to its own behaviour go through review. The wide-reach agent earns its autonomy by having its reach engineered down first.
The method
When someone proposes a new agent, or new authority for an existing one, the sequence I use looks like this:
- List permissions, not features. "Summarise support trends" is a feature. "Read access to the ticketing system" is a permission. Only the second can hurt you.
- Name the worst case per permission, assuming the agent misuses it as effectively as possible. Not "it might make mistakes", but the specific bad outcome: deleted records, an email to the wrong list, money moved.
- Sort by reversibility. Reversible worst cases can be autonomous. Irreversible ones get a confirmation gate, a narrower scope, or removed from the agent entirely.
- Shrink before you supervise. A human in the loop is the expensive control. Before reaching for it, ask whether the permission can be scoped down until its worst case is tolerable. Ticket-creation-only is a design outcome, and it bought total autonomy.
- Re-run the exercise when anything changes. Every new integration changes the blast radius, and yesterday's autonomy setting was calibrated to yesterday's permissions.
Why this framing wins arguments
There is an organisational payoff beyond the engineering one. "Should agents be autonomous" is an argument that never ends, because it is really an argument about trust in a technology, and people's priors differ. "What is the worst this specific permission allows, and is that reversible" is an argument that ends in an afternoon, because it is about facts you can enumerate. I have watched the blast-radius framing turn a stalled approval into a scoped yes more than once, including at board level.
It also gives you a growth path. An agent that has run cleanly inside a small blast radius has earned evidence, and evidence supports the next, slightly larger grant of authority. Autonomy stops being a leap of faith and becomes a ratchet: earned, bounded, and always sized to what the permissions actually allow.