Autonomy levels

The five autonomy levels framework applies the classical Sheridan-Verplank grid (1978), designed for human-machine systems, to the contemporary situation of AI agents. The central idea: autonomy is not binary, it is graded. The higher you go, the more the machine takes over observation, reasoning, decision and execution. The more human responsibility shifts from operation to supervision.

The five levels in practice

• Level 1, Suggestion: the machine proposes, the human chooses and executes. Example: Copilot suggests code, the developer validates.
• Level 2, Execution under validation: the machine proposes and executes after explicit human validation. Example: a sales follow-up agent that drafts emails and waits for your OK.
• Level 3, Bounded autonomy: the machine decides and executes alone within a defined scope, escalates outside scope. Example: ticket-triage agent answering known cases, escalating new ones.
• Level 4, Supervised autonomy: the machine decides and executes on everything, the human audits after the fact and corrects biases. Example: credit-scoring agent with weekly decision audit.
• Level 5, Total autonomy: the machine decides, executes, learns and corrects itself with no human intervention except in serious incident. Very rare in production for high-stakes decisions.

The vast majority of 2026 AI-agent projects target level 3, occasionally level 4 on well-bounded cases. Level 5 is neither desirable nor reachable in regulated contexts: the EU AI Act requires effective human oversight on every high-risk AI (article 14).

Why 90% of projects stop at level 2

Going from level 2 to level 3 requires four things no generic framework provides: a formal scope the agent cannot bypass, an auditable structured memory, a confidence-calibration mechanism, and configurable approval gates. Without these four, the agent stays an assistant that proposes, because you cannot trust it to decide alone. It is the main bottleneck of enterprise agent projects.

The five-level framework is useful for any executive steering an AI-agent project. It first serves to diagnose where you are: most 2024-2025 projects are still at level 2 while the marketing pitch promises level 4. It then serves to objectify the architectural requirements to climb a tier: what must be added to existing architecture for the agent to gain autonomy without losing governance.

Swoft architecture is designed to operate agents at level 3 by default, with possible extension to level 4. Formal scope is carried by the DDD metamodel's Bounded Contexts: an agent technically cannot write in a domain it isn't attached to. Structured memory is the Event Store: every observation and decision is a typed event. Confidence calibration is explicit (every AI decision carries a score). Approval gates are dynamically injected into sagas via configurable business rules.

This combination lets a Swoft agent operate at level 3 from go-live, with no extended babysitting phase. Human oversight remains effective via approval gates and dual attribution, in compliance with the EU AI Act.