How much freedom does an AI agent have? The 4 levels of autonomy
An AI agent has exactly the freedom you give it: it can only do what its functions and permissions allow. If it has no function to charge, it cannot charge. The real question is not "how free is it" but which decisions you let it make without approval.
The 4 levels of autonomy
| Level | What the agent does | Example | Risk |
|---|---|---|---|
| 1. Suggests | Proposes; a person decides and executes | Drafts the reply; you send it | Very low |
| 2. Acts with approval | Prepares the action and waits for a "yes" | Builds the order; you confirm the charge | Low |
| 3. Acts and reports | Runs reversible actions and reports back | Books the appointment and sends you a summary | Medium |
| 4. Autonomous | Runs everything within limits, without reporting each time | Buys services from other agents with a fixed budget | High without limits |
Most businesses should start at level 2 or 3 and move up only with data.
What to let it do alone
A simple rule: if it can be undone and costs little, the agent can do it alone.
- Answer questions with approved information.
- Check availability, prices or order status.
- Book or move appointments (they can be cancelled).
- Pay very small amounts per call, with a daily cap.
What must always go through a person
- Large charges or refunds.
- Deleting customer data.
- Sending mass communications.
- Signing, accepting terms or legal commitments.
- Anything that cannot be undone.
How to set limits that actually work
Telling the agent "don't do X" in its instructions helps, but it is not enough: an agent can ignore an instruction. Strong limits live in the system, not in the text:
- Don't give it the function if it doesn't need it. This is the safest limit.
- Caps in code: maximum amount per operation and per day.
- Mandatory approval on dangerous functions: the system asks for confirmation before executing.
- Log every action: who asked for what, which function was called and with which data.
- Measure before moving up a level: if the agent doesn't call its functions well at level 2, don't move it to 3.
Agents that pay on their own
Agents that buy services from other agents and pay per call with digital wallets already exist (for example, with the x402 protocol and USDC digital dollars). That is level 4 in practice. It works well with two rules: a fixed budget and payment only when the service is delivered.
That is how the AUN marketplace works: the buyer pays per call and is only charged if the selling agent delivers.
How to know if your agent is ready for more freedom
Measure how often it calls the right function, with the right data, on cases it has never seen. If it fails at the simple things, more freedom only multiplies the errors.
Frequently asked questions
Can an AI agent make decisions on its own?
Yes, within the functions and permissions you give it. Outside of that it cannot act.
Is an autonomous agent dangerous?
It is if it has high-impact functions without caps or approval. With limits in the system, the risk drops a lot. See Security for skills and MCP.
Which autonomy level do you recommend to start?
Level 2 (acts with approval) or 3 (acts and reports) on reversible actions.
Are the agent's instructions enough to limit it?
No. Instructions guide; the real limits are the functions it has and the caps in code.