AI Agent Autonomy Levels: How Much an Agent Can Do on Its Own

An AI agent that only suggests helps little. An agent that does everything on its own can cause damage nobody notices in time. Between the two extremes lies a central decision in any AI project inside operations: how much the agent can do without a person checking.

Here you will see the four autonomy levels we use for agents in production, how to measure the cost of an error, how an agent moves up and down a level, which controls go with each level and where human review is mandatory, with a table of examples by area.

What are the autonomy levels of an AI agent?

An AI agent uses a language model to decide the next step, call a tool (CRM, email, spreadsheet, database), read the result and decide again, until the task is done. The autonomy level says how much of this loop happens without a person in the middle:

• Level 1: suggests. The agent prepares and the person decides and executes. Example: it drafts the reply to a customer, which someone reviews and sends. For very expensive errors.
• Level 2: executes with approval. The agent builds the complete action and waits for the go-ahead. Example: the email to the customer only goes out after approval. For expensive errors.
• Level 3: executes and notifies. The agent acts and posts what it did in the team channel, which corrects it if needed. Example: it classifies support tickets and notifies the team on Slack or Teams. For moderate errors.
• Level 4: executes on its own. The agent runs without intervention, and the team checks samples or looks when an alert fires. Example: it generates the daily metrics summary. For cheap errors.

The rule behind the choice fits in one sentence: the more expensive the error, the lower the step.

The level is set per action, not for the whole agent. A support agent can classify tickets at level 3 and only suggest replies to customers at level 1.

How do you measure the cost of an error?

Picture the agent getting that task wrong and answer five questions:

• Is the error reversible? A wrong label on a ticket is fixed in seconds. A sent email, a payment made or a deleted record do not come back.
• Does it reach the customer? What leaves the company speaks in its name. An internal error gets fixed at home.
• Does it touch money? Billing, discounts, refunds, payments and prices.
• Does it involve personal data? Customer or employee data brings obligations under data protection law and the risk of exposure.
• Does it affect the company's image? A public message or the wrong tone with an important customer.

A "yes" to any question already pulls the task down. Irreversible and with the customer involved, it stays at level 1 or 2, however good the agent looks. Add a sixth question: how long does it take someone to notice the error? One that shows up in the same minute costs less than one that goes unseen for weeks.

How do you combine the cost of an error with how often the task runs?

The cost of an error says how much care the task needs. Frequency says how much time automation gives back:

Frequency	Cheap error	Expensive error
High	Level 3 or 4. This is where the biggest time savings are, with sample checks.	Level 2, with a fast approval queue, or split the task into parts with different risk.
Low	Level 3 or 4, but the gain is small. Check whether it is worth building.	Level 1. The agent prepares and the person does it.

The most tempting and most dangerous quadrant is the frequent task with an expensive error. The way out is usually to split the task: in customer service, classifying the ticket stays at level 3 and the reply to the customer at level 2. And volume multiplies errors: a small error rate, over hundreds of runs a day, turns into several errors a day.

How does an agent move up a level over time?

No agent should start at the level where it will end up. Autonomy comes gradually, based on numbers:

1. It starts by suggesting. In the first weeks, the agent stays at level 1 and the team compares each suggestion with what they would do.
2. It measures accuracy on samples. Record whether the suggestion was accepted unchanged, accepted with edits or rejected. Decide beforehand which rate justifies moving up.
3. It moves up one step when the numbers hold. One at a time, based on a measurement period, not on impressions.
4. It keeps being measured at the new level. At levels 3 and 4, someone checks a sample of what the agent did every week.
5. It moves down when something changes. A new model, an edited prompt, a new process, a drop in accuracy or an incident: the agent goes back one step until it is measured again.

Anthropic's guide on building effective agents points the same way: extensive testing in sandboxed environments, pauses for human feedback and stopping conditions, such as a maximum number of iterations. With agent operations, UEEK tracks these measurements month by month and decides with your team when an agent moves up or down a level.

Which technical controls go with each level?

The autonomy level cannot depend on the prompt alone. "Never send without approval" helps, but the real control lives in the system:

• Separate read and write permissions. At level 1, the agent only reads. Write access is granted per action, not for the whole system.
• Authorization outside the model. OWASP recommends enforcing authorization in the downstream systems, instead of letting the model decide whether an action is allowed. If the CRM does not let the agent delete contacts, no text will convince it to delete.
• Value and volume limits. A cap per action and per day. Above the cap, the action automatically drops to approval.
• Approval queues. Where the action waits, who approves and how fast. If nobody approves, nothing goes out.
• Logs. What the agent read, decided and did, and who approved. Without records there is no way to measure accuracy or investigate an error.
• Alerts. A warning when volume, error rate or AI usage cost goes off pattern.
• Stop button. It interrupts the agent and leaves everything in a safe state. Article 14 of the EU AI Act requires that high-risk systems can be interrupted through a stop button or a similar procedure.

The complete design, with connectors, rules and tests, is in how to build an AI agent for operations.

Which risks call for extra care?

• Data protection and automated decisions. In Brazil, article 20 of the LGPD, the general data protection law, gives data subjects the right to request review of decisions made solely on the basis of automated processing that affect their interests, such as those that define consumer or credit profiles. Article 6 sets the necessity principle: only data that is relevant and not excessive. Customer and employee data only enters a flow with a legal basis and at the minimum necessary. The ANPD, Brazil's data protection authority, provides guidance and enforcement.
• Human review where errors are expensive. Anything that speaks to the customer, touches finance or decides something about a person goes through someone before it counts.
• AI usage cost. Reasoning models get complex tasks right more often, but take longer and cost more per answer. In an agent that runs hundreds of times a day, that adds up. Choose the model by task and set a cost alert.
• Credentials. Keys and passwords never go into a prompt, a document or a repository. The agent uses its own credentials, stored in a secrets vault, with the smallest possible scope.
• Prompt injection. The OWASP Top 10 for LLM Applications ranks prompt injection first. In its indirect form, the malicious instruction is hidden in an email, page or attachment the agent reads. An agent that reads outside content should not have sensitive actions at level 4.
• Excessive agency. In OWASP, excessive agency is the risk of damaging actions triggered by an unexpected, ambiguous or manipulated model output. The causes: functionality, permissions or autonomy beyond what is needed. Mitigations include least privilege and human approval for high-impact actions.
• Approval that becomes a rubber stamp. Article 14 of the AI Act warns about the tendency to over-rely on the system's output. A queue with no rejections and approvals that take a few seconds means either the agent deserves to move up or nobody is really checking.

To organize AI governance on an ongoing basis, the NIST AI Risk Management Framework is a good reference. If you want this map built for your operation, the AI map with an expert lists the candidate tasks, the cost of error for each one and the starting level.

Which autonomy level should each area use?

The examples are starting points. The final level depends on the numbers measured in your operation.

Area	Task	Recommended level	Why
Sales	Research the company before the meeting	4. Executes on its own	Internal use, read only
Sales	First reply to a website lead	2. Executes with approval	Speaks to the customer
Support	Classify tickets and notify the team	3. Executes and notifies	Internal and easy to fix
Support	Reply to the customer based on the help center	1 at first, 2 after measuring	Speaks to the customer
Finance	Weekly summary of revenue and costs	4. Executes on its own	Internal, read only
Finance	Payment reminder to overdue customers	2. Executes with approval	Customer and money
Finance	Payment or refund	1. Suggests	Money and irreversible
HR and payroll	Answer internal questions about policies	3. Executes and notifies	Internal, based on an approved document
HR and payroll	Resume screening or a decision about a person	1. Suggests	Personal data and article 20 of the LGPD
Operations	Daily metrics summary	4. Executes on its own	Cheap error, easy to notice
Operations	Purchase order to a supplier	2. Executes with approval	Money, with a value cap

More examples, with trigger, input and destination, are in AI routines by area. To see where your company stands, from one-off chat to a routine that runs on its own, read the five steps of AI in operations.

How does the right autonomy free up team hours without losing control?

With the end of the 6x1 schedule under discussion in Brazil, many companies want to keep operations running with fewer hours per person. Levels 1 and 2 take the preparation work off the team: researching, assembling, drafting. Levels 3 and 4 take the whole task off the desk, and that is where the biggest time savings are.

The common mistake is wanting level 4 gains in tasks that call for level 2. By starting low and moving up with numbers, the team saves time from day one without losing control of what goes out in the company's name. See how to organize this in the 5x2 schedule: how to keep operations running without losing productivity.

Frequently asked questions

What is human in the loop?

It is the design in which a person approves, edits or rejects the agent's action before it counts, as in levels 1 and 2. At levels 3 and 4, human oversight happens afterwards, through notifications, sampling and alerts.

Can an agent start straight at level 4?

Only for internal, read-only tasks with cheap errors, such as a metrics summary. Even then, check the results in the first weeks.

Doesn't human approval cancel out the time savings?

No, if the queue is well designed. Reviewing a ready reply takes far less time than writing from scratch, and the gain grows as the agent moves up a level.

Does the LGPD forbid automated decisions?

No. Article 20 gives data subjects the right to request review of decisions made solely by automated processing that affect their interests and to receive information about the criteria used. Decisions about people need a review path and documented criteria.

What should you do when the agent makes a mistake in production?

If the error repeats, use the stop button. Fix the effect, read the logs, move the agent down one step and adjust the rule, prompt or limit that let the error through.

Sources

• Law 13.709/2018, Brazilian General Data Protection Law (LGPD), articles 6 and 20
• Brazilian National Data Protection Authority (ANPD)
• OWASP Top 10 for LLM Applications
• OWASP, LLM01:2025 Prompt Injection
• OWASP, LLM06:2025 Excessive Agency
• EU AI Act, article 14: human oversight
• NIST AI Risk Management Framework
• Anthropic, Building effective agents

How UEEK can help

UEEK has worked for 14 years with digital products, for more than 200 clients, in 6 countries, on more than 500 projects. The AI map with an expert defines where to start and at which level, AI agents in production go live with permissions, approval queues and logs from day one, and agent operations tracks accuracy and cost, and decides with you when each agent can do more on its own.

Talk about running your agents