Defining autonomy boundaries for AI agents

Three tiers of authority

For every agentic workflow I document three lists. Unattended: retries, schema re-inference, enrichment, and classification proposals. Requires approval: any logic change, any policy change, and anything that alters a published number. Never automated: deletion, policy override, access grants, and anything irreversible without a recovery path.

This is straightforward to produce, and it is the difference between an agent program that survives its first incident and one that does not.

Earning autonomy

Every agent starts in propose-only mode and moves to bounded auto-apply after a clean proposal record over a meaningful sample, against a documented threshold. Confidence thresholds are risk-tiered. The bar for merging two records in a marketing database differs from the bar for merging them in a regulated safety database.

Logging, oversight, and audit capability go in before agents touch production systems.

Where agents contribute most

Multi-step transactional work that requires tool-calling and write access. Autonomous incident response, where the agent detects a failure, correlates across lineage, forms a hypothesis, validates a fix in a sandbox, and presents it for approval. Legacy logic archaeology, parsing old ETL metadata to recover undocumented business rules. In each case the constraint was analysis and verification rather than authoring.