Autonomy Tiering: Deciding How Much Agency to Grant
Five tiers from advisory to privileged autonomous, with the approval authority and control set each one requires.
Autonomy is not binary and should not be granted uniformly. Assign every agent a tier, and require that controls scale with tier.
4.1 Security Autonomy Tiers #
| Tier | Description | Human involvement | Permitted scope | Approval authority |
|---|---|---|---|---|
| T0Advisory | Generates output; no execution capability | Human performs all actions | Read-only, non-sensitive data | Team lead |
| T1Supervised execution | Executes, but each side-effecting action is approved | Per-action approval | Scoped writes to non-critical systems | Application owner + security review |
| T2Bounded autonomous | Executes within a defined envelope; approval only for exceptions | Exception-based; full audit | Defined tool set, defined destinations, defined data classes | Security architecture review board |
| T3Broad autonomous | Multi-step, long-horizon, minimal per-action oversight | Post-hoc review + automated halt | Broad but enumerated; production systems in scope | CISO or delegated executive |
| T4Privileged autonomous | Acts on security, identity, financial, or safety-critical systems | Dual control; independent monitoring | Explicitly enumerated; time-boxed | CISO + business executive; documented risk acceptance |
4.2 Rules That Apply Across Tiers #
- Tier is assigned to a deployment, not to a product. The same agent framework may run at T1 in one context and T3 in another.
- Tier escalation requires re-review. There is no automatic promotion through demonstrated good behavior.
- Every agent at T2 and above requires a named human owner who is accountable for its actions and is not a distribution list.
- T4 agents require an independent monitoring path—the system watching the agent must not be governable by the agent.
- Any agent operating with reduced or disabled safety classifiers is automatically treated as T4 regardless of its nominal function, and must run in an isolation tier stronger than the production environment it would otherwise inhabit.
That last rule deserves emphasis, because its violation is the direct cause of the most significant agent security incident on record to date. Evaluation and red-team environments running models with safety refusals reduced are routinely afforded weaker isolation than production, on the theory that they are “just testing.” The opposite is correct.