The autonomy contract

An agent passes its tests, and its sponsor asks a plain question. How much may it do on its own? The autonomy contract answers that for one piece of work. It is the agreed level and the controls that level needs. It uses two scales. The autonomy scale says how freely the agent acts. The learning scale says whether, and how, it may improve. Autonomy is recorded three ways: designed, permitted and exercised. The organisation's readiness sets a ceiling on how high the agent can go. Do not grant a level that people cannot supervise.

The autonomy scale

Six levels, from a person doing all the work to the agent running alone under set rules.

• Manual (A0): a person does all the work, with no AI.
• Assisted (A1): the agent suggests, and a person acts.
• Delegated tasks (A2): the agent does set tasks, and a person reviews every output.
• Supervised autonomy (A3): the agent acts. A person approves anything that cannot be undone and handles exceptions.
• Managed autonomy (A4): the agent runs, and people work a queue of exceptions.
• Governed lights-out (A5): the agent runs alone inside set rules. People set the policy, own the outcome and audit the results.

Set the level for each piece of work, not for the agent as a whole. One agent can run at A3 for clear cases and A2 for the rest. Other published autonomy scales map onto these six in the crosswalk on the risk profile.

The learning scale

Four levels, from fixed behaviour to learning that runs all the time inside limits.

• Fixed (L0): behaviour changes only when people release a new version.
• Curated learning (L1): people choose the examples and sources it learns from.
• Reviewed learning (L2): improvements are proposed, tested and approved by a person before release. This is the learning flywheel.
• Continuous learning inside limits (L3): it improves on its own inside fixed limits. Every change is still tested, and it can be rolled back.

The two scales move independently. Each piece of work sits at a chosen point on both. A move up is earned. A move down can happen at any time.

Record autonomy three ways

• Designed: what the build allows.
• Permitted: what this contract grants.
• Exercised: what the logs show the agent actually did.

Controls follow the higher of permitted and exercised. Exercised above permitted is an incident. This happens in practice. The MIT AI Agent Index (2025 edition) studied enterprise agents. They were set up at low autonomy, but many ran at high autonomy once deployed.

The controls at each level

Each step up comes with a fixed list of controls. That list is the agreement. The level name is only its label.

Three rules join the two scales.

• Managed autonomy (A4) and above need reviewed learning (L2) or better. At that level, people must be able to improve the agent's reliability, not only watch it.
• A4 and above need proven supervision capacity. People must keep up at peak load, as set out below.
• No learning loop means fixed behaviour. Fixed behaviour is the right choice for many tasks. Record it as fixed (L0).

Readiness sets the ceiling

Seven areas of readiness are each scored from 0 to 3. The scores mean absent, ad hoc, managed and operated. Each area has four yes, partly or no questions in the readiness assessment.

1. Data: who owns the data, its class, its quality, and agent memory. Retrieval must respect each person's access rights.
2. Integration and tools: governed APIsAPI. A defined way for software to talk to other software. Agents reach systems through governed APIs rather than through screens. and tools reached through a gatewayGateway. The single door every agent request passes through on its way to a tool or model. Because everything goes through it, it is where rules are enforced and activity is recorded.Read the page. The agent can act with the requesting person's permissions. Long-running actions are safe to retry.
3. Identity and registry: every agent is in one registryAgent registry. The official list of agents: what each is for, who owns it, what it may touch, and which version is live.Read the page with a named sponsor. The registry lists your own agents and vendor-embedded agents. Credentials are short-lived and never held by agents. The off switch is tested.
4. Controls on actions: a risk tier, a policy decision pointPolicy decision point. The component that says yes or no to an action by checking rules against who is asking. The agent asks, the decision point decides, and the agent cannot skip it.Read the page outside the model, and sandboxed code. A person makes any decision about a person.
5. Testing and operations: observabilityObservability. Being able to see what agents did, step by step, from records the agent cannot alter., evaluations before and after release, re-testing on every change, and incident practice.
6. Cost and value: intake with agreed conditions for stopping, token budgets with a hard stop, and cost per resolved outcomeCost per resolved outcome. What it costs to actually solve one case, including supervision time and the cost of wrong answers, rather than what one run costs.Read the page.
7. People and operating model: named owners and supervisors, clear exceptions, and capacity for bursts of work.

The weakest area sets the ceiling, not the total. Read the profile in this order: data, integration, identity, controls, testing, cost, people.

Two overrides tie the ceiling to the risk profile. Each can only lower it. A Tier 3 (strict) workload needs controls at 3 for A3 or above. The second override is the Rule of TwoRule of Two. One session should hold at most two of three things: untrusted input, sensitive data, and the power to change state or send things out. All three together means a person approves each action.Read the page. A session that holds untrusted input, sensitive data and an external action is capped at A2, whatever the scores.

Identity gaps cap autonomy without blocking a start. A piece of work can begin at A1 while the delegation chain is built. That chain traces every action to the person who asked.

Readiness is scored on controls that are in place. A count of clean runs does not count. A short run of passes is a small sample, and it can hide a real failure rate.

Step up and step down

• Step up one level at a time. Each step needs the controls for that level in place, evaluation results, and the readiness scores.
• Step down at once. An anomaly, a change of scope, or exercised autonomy above permitted moves the agent down straight away.
• Every move is a change. A move on the autonomy scale is one of the change triggers in the agent lifecycle. The evaluations and the risk profile run again.

Check that people can keep up

From managed autonomy (A4), people handle the agent's exceptions in a queue. They must keep up at the busiest moment, not on an average day. This is the supervision gate on A4 and above. No credible ratio of people to agents has been published, so measure your own.

• Span of control. Span of controlSpan of control. How many agents or tasks one person can supervise at once. It shrinks as waiting times grow.Read the page is how many agents one person can supervise. It depends on three times. Neglect time is how long an agent can safely run alone. Interaction time is how long a person needs for each intervention. Wait time is how long items sit in the queue. Leaving out the wait time overstates capacity by up to 67 percent. The calculation is on the operating model and supervision layer (R13).
• Plan for bursts. Set supervision budgets as a burst rateBurst rate. Demand measured at its busiest moments rather than averaged over a day. Oversight capacity is planned against bursts.Read the page: items per ten minutes at the busiest time. Never use a daily average. Alarm-management standards dropped their per-day measure for this reason. A daily target can look fine on the dashboard and still fail in every burst.
• Expect more interventions, not fewer. With experience, people give agents broader standing permission. They also step in more often. In measured deployments, auto-approval roughly doubled, and interruptions nearly doubled with it [vendor]. That is calibrated oversightCalibrated oversight. As operators gain experience they grant broader standing permission and also step in more often, rather than supervising less.Read the page, and it means the system is working. Fewer interventions as autonomy grows is the thing to investigate.

Track the intervention rate and its trend, escalations by cause, wait time per item, and the cost of each review. Add blind checks now and then against self-reported figures.

One agent, one contract

A power distributor runs the vegetation inspection agent. It flags trees and plants growing too close to power lines in aerial images. It also creates inspection requests. Its sponsor asks whether it can create requests without a field crew confirming each one. That would be supervised autonomy (A3).

The distributor scores its readiness. Data, integration, testing and people score 2. Identity, controls and cost score 1. The A3 row needs identity and controls at 2, so the ceiling is delegated tasks (A2). The contract permits A2, with curated learning (L1). People choose the images and past cases it learns from. The build allows A3, so the record shows designed A3 and permitted A2. The sponsor checks the logs for any request sent without a crew's confirmation. That would be exercised above permitted, which is an incident.

To step up, the distributor brings identity and controls to 2. Then the evaluations and the risk profile run again. The agent creates requests that change work plans, so it is already Tier 2 (enhanced). A3 needs at least Tier 2, so the tier stays the same.

Evidence and limits

The autonomy levels follow published scales, but no cross-industry standard exists. Feng, McDonald and Zhang give five levels, set by the user's role (June 2025). The AWS scoping matrix gives four scopes (21 November 2025). The crosswalk on the risk profile maps both to the six levels here.

The learning scale is this guide's own. No vendor publishes a levelled scale. AWS and Google describe an improvement loop instead, and reviewed learning (L2) matches that loop.

The ceiling table and the step rules are expert judgement. They have not been tested against incident data.

No credible ratio of people to agents has been published. The vendor that coined the measure has published no number in two annual editions. The capacity figures on this page come from published queueing studies and alarm-management standards, gathered in the operating model research. The trend in auto-approvals and interruptions comes from vendor platform data.

Next step

Score the agent's risk on the risk profile. Then check the organisation's scores with the readiness assessment.

Explore this topic

• The autonomy and learning scales, with the supervision gate
• Readiness assessments
• Operating model findings

Clean runs. Nineteen passes in twenty runs fits a true pass rate as low as 78 percent, at one-sided 95 percent confidence. A gate set on a count of clean runs can also revoke an agent that is working well.

The span-of-control relation. Span of control equals neglect time divided by the sum of interaction time and wait time, plus one. The plus one is the agent being handled at that moment. This is the form the operating model research uses. Leaving wait time out overstates capacity by up to 67 percent, and by 36 percent even where agents only raise exceptions.

Sources:

• MIT AI Agent Index, 2025 edition
• Feng, McDonald and Zhang, levels of autonomy for AI agents, arXiv 2506.12469, June 2025, revised 28 July 2025
• AWS Security Blog, the agentic AI security scoping matrix, 21 November 2025 [vendor]
• Amazon Bedrock AgentCore release notes, the observe, evaluate, optimise and deploy loop, May 2026 [vendor]
• Gemini Enterprise Agent Platform overview, the Optimize pillar, updated 13 October 2026 [vendor]
• Anthropic, measuring AI agent autonomy in practice, 18 February 2026 [vendor]