- Home
- AI agents
- What is an AI agent?
- Levels of autonomy, and when not to use an agent
Plan · What is an AI agent?
Levels of autonomy for AI agents, and when not to use an agent
Autonomy is how much an agent does before a person steps in, from carrying out one instruction at a time to acting on its own while a person monitors. It is a design choice you make per workflow, separate from how capable the model is, and the level you pick is a statement of which controls you have built.
In this guide: 83 pages
Key takeaways
- Two public frameworks give you the vocabulary: five user-role levels from Operator to Observer (University of Washington, June 2025) and four security scopes from no agency to full agency (AWS, November 2025). Use the first to design and the second to list the controls.
- Start one level lower than the business case asks for, and raise it on evidence: an evaluation pass rate, an approval edit rate below a threshold, and three months of traces.
- Workflows beat agents whenever you can draw the flowchart. Anthropic’s advice is the simplest solution that works; OpenAI’s three tests for an agent are complex decisions, hard-to-maintain rules and unstructured data.
- Do not build an agent for a step that must run exactly once with no approval, for a workflow with no evaluation set, or for a decision a regulation says a person must make anyway.
What are the levels of autonomy for AI agents?
Five, in the framework we use: Operator, Collaborator, Consultant, Approver and Observer, defined by what the user does. AWS’s security scoping matrix cuts the same range into four scopes defined by what the agent may change without a person.
The University of Washington paper "Levels of Autonomy for AI Agents" (Feng, McDonald and Zhang, submitted 14 Jun 2025) defines the levels by the user’s role. Operator means the user directs and the agent carries out the instruction; Collaborator, they plan and execute together; Consultant, the agent leads and consults the user; Approver, the agent involves the user only for risky or pre-specified cases; Observer, the agent has full autonomy and the user monitors. The paper’s argument, and ours, is that autonomy is a design choice separate from capability: a very capable model can and usually should run at Approver.
AWS published its Agentic AI Security Scoping Matrix on 21 Nov 2025 from the security side, with four scopes defined by what the agent may change without a person and a list of security controls per scope. The table maps the two frameworks onto each other; the mapping is ours.
Microsoft’s red-teaming documentation adds a third cut, by action rather than by agent: prohibited actions are never allowed, high-risk actions such as financial transactions are allowed with human-in-the-loop confirmation, and irreversible actions such as file deletions are allowed with disclosure plus confirmation. In practice an agent carries several levels at once: Observer on reads, Approver on writes, and a hard block on the prohibited list.
The four AWS scopes, the user-role levels they map to in our reading, and the controls we expect at each scope.
| AWS scope | What the agent may do | User-role level | Controls we expect |
|---|---|---|---|
| Scope 1, no agency | Read-only, fixed steps; humans approve all actions | Operator | Content filters, knowledge permissions, logging |
| Scope 2, prescribed agency | Changes things only with human approval | Collaborator, Consultant, Approver | An approval gate per write, an agent identity, a tool allow list, traces |
| Scope 3, supervised agency | Plans and acts without approval; humans set goals and may intervene | Observer, with limits | Policy on every tool call, spend and rate limits, a kill switch, online evaluation |
| Scope 4, full agency | Starts work from triggers in its environment, runs continuously, minimal oversight | Observer | Everything above plus sandboxing, egress limits, anomaly detection and a tested containment runbook |
How do you pick the level for a workflow?
By the cost of a wrong step and by the evidence you have. Reversible, low-value, well-tested steps can run at Observer; anything irreversible, expensive or regulated starts at Approver and stays there until the traces show it is safe to move.
- The damage one bad tool call can do, first. A wrong draft costs a minute; a wrong payment or a wrong deletion costs more than the agent saves in a month. Irreversible actions start at Approver, or stay off the tool list.
- Evidence second. An agent with no evaluation set has no business past Operator. Set a pass bar per level, for example 95% correct proposals before Approver, and an approval edit rate below 5% for three months before any step runs without a person.
- Accountability. The EU AI Act’s human oversight article asks that overseers can understand the system’s limits, stay aware of the tendency to over-rely on its output, and intervene or stop it; the Annex III high-risk obligations apply from 2 Dec 2027. Design the approval screen for that reader now.
- Exposure to untrusted input. Meta’s Agents Rule of Two (31 Oct 2025) says an agent that in one session reads untrusted content, holds private data and can communicate externally should not run autonomously. Drop one of the three, or add a person.
- Model reliability on your tasks. METR’s May 2026 report put the public frontier at about 12 hours of human-equivalent task length at 50% success and about 1.5 hours at 80%. Long autonomous runs are a research result and a production risk.
Write the level down with the scope, the pass bar and the date of the next review. A level that is not written down drifts upward: approvals clicked without reading raise it in practice without anyone deciding to.
Workflow or agent: which one should you build?
A workflow when you can draw the flowchart, an agent when you cannot. Anthropic’s rule is to find the simplest solution and add complexity only when needed; OpenAI’s three tests for an agent are complex decision-making, rules that are hard to maintain, and heavy reliance on unstructured data.
Anthropic’s December 2024 essay gave the industry its vocabulary: workflows orchestrate models and tools "through predefined code paths", and agents let the model "dynamically direct their own processes and tool usage". It also named five workflow patterns to try before building an agent: prompt chaining, routing, parallelization, orchestrator-workers and evaluator-optimizer. A model inside a workflow still does the reading and the classifying; what it does not do is choose the path.
The frameworks encode the same choice. Strands, the SDK behind AWS’s managed harness, puts it in one line: use Graph when you want to define the flow, Swarm when agents should coordinate on their own, and Workflow when the process is fixed. Microsoft Agent Framework offers sequential, concurrent, handoff and group-chat orchestration plus declarative workflows; Google ADK 2.0 added a graph-based workflow runtime on 19 May 2026; LangGraph is a graph of nodes with a model deciding at some of them. Copilot Studio shows the split inside one product: agent flows are deterministic, and the GitHub Copilot harness takes a goal and breaks it into steps.
Durable execution is the part people forget. A workflow that waits a day for an approval has to survive a deployment and a crash without starting over, and without paying for a container while it waits. AWS Step Functions Standard workflows run up to a year with exactly-once semantics; Lambda durable functions (2 Dec 2025) suspend for up to a year with no idle charge; Microsoft Agent Framework checkpoints workflows, and its Durable Extension (preview at 1.0) waits days or weeks on Azure Functions. Put the agent’s decisions inside a durable workflow and the audit trail comes with it.
The decision, by the shape of the work.
| If | Build | Because |
|---|---|---|
| The steps are known and the rules are stable | A workflow or a flow, with a model only where text must be read or classified | Replayable, testable in advance, low cost per run |
| The steps vary by case but each step is known | A workflow with routing: a model classifies, deterministic branches execute | The model’s decision is one node you can test; the rest never varies |
| The path cannot be written down and the inputs are unstructured | A single agent with a bounded tool list and approval on writes | Only the model can choose the path; the controls keep it inside the limits |
| The work is broad and parallel, such as research across many sources | An orchestrator with worker agents, if the task value covers about 15 times the tokens of a chat | Anthropic’s own measurement; multi-agent pays off only on high-value work |
| Any step must run exactly once with no approval | A workflow, with idempotency keys on every side effect | Approval does not make execution exactly-once, and at-least-once engines retry |
When should you not use an agent at all?
When the flowchart already works, when the action must run exactly once, when you cannot write a test set, when the cost per task exceeds its value, and when the decision belongs to a person by law or by policy. Each of these shows up in the sourced failure data on the next page.
- A stable, rule-based, high-volume step. The same input must give the same output; a flow does that and an agent does not. Gartner’s analysts, as reported by Reuters in June 2025, expected more than 40% of agentic AI projects to be cancelled by the end of 2027 over cost and unclear value, and building an agent where a flow would do is one way to join that number.
- An action that must run exactly once with no person in the loop. Approval does not guarantee exactly-once execution, durable engines retry, and a resumed node re-runs from the start. Payments, messages to customers and deletions need idempotency keys and, usually, a person.
- A workflow with no evaluation set. If you cannot collect a few dozen real cases with the right answer, you cannot tell whether the agent works, and you cannot tell when a model change breaks it.
- A task where the input needs parsing rather than reading. Structured records with known fields belong to a connector or a query, at a fraction of the cost and latency.
- A decision a person must make anyway. Where regulation or policy requires a human decision, the agent can prepare the case and nothing more; design it as Collaborator and do not pretend the approval is the control.
- An agent that would hold the lethal trifecta: private data, untrusted content and a way to send data out, in one session with no approval. Prompt injection through what the agent reads is the top item in OWASP’s agentic Top 10, and classifiers alone do not stop it.
The page on why AI agents fail in production has the numbers behind each of these.
How do Microsoft, AWS and Google implement it?
The mechanisms that set and enforce a level on each cloud, with statuses as the vendor pages showed on 2 Nov 2026.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| Approval on a tool call | Microsoft Agent Framework approval_mode always_require; Foundry MCP tool require_approval (default always); Copilot Studio multistage approvals (preview) | AgentCore harness return-of-control and human-in-the-loop tools; Step Functions waitForTaskToken callbacks | ADK require_confirmation (experimental); computer use tool with a human-in-the-loop safety policy (GA 30 Oct 2026) |
| Conditional rules on a tool call | Copilot Studio multistage approvals with conditions between stages (preview) | AgentCore Policy (GA 3 Mar 2026): Cedar rules on role and arguments that permit or deny the call, a deterministic complement to human approval | ADK require_confirmation as a function of the arguments |
| Deterministic alternative | Agent flows in Copilot Studio; Agent Framework workflows with checkpointing | Step Functions Standard (up to one year, exactly-once); Lambda durable functions | ADK Sequential, Parallel and Loop workflow agents; ADK 2.0 graph workflows |
| Stop or contain | Block in the Microsoft 365 admin center; Foundry Control Plane stop (existing runs continue) or block; disable the Entra agent identity; Conditional Access templates | Repoint a named AgentCore Runtime endpoint to a previous version; deny the tools in AgentCore Policy | Block at Agent Gateway; remove the IAM bindings; unregister from Agent Registry |
Foundry’s stop does not end runs already in progress, and blocking a Foundry agent in the Microsoft 365 admin center only affects Copilot Chat, so test the switch before you rely on it.
Frequently asked questions
What is the difference between an autonomous agent and a semi-autonomous one?
Whether a person approves actions before they happen. Semi-autonomous means Approver or below: the agent proposes and a person confirms the risky steps. Autonomous means Observer, or AWS Scope 3 and 4: the agent acts and a person monitors. Most enterprise agents should mix the two, Observer on reads and Approver on writes.
How do we raise an agent’s autonomy safely?
On evidence, one step at a time: an evaluation pass bar for the next level, an approval edit rate below a threshold for a set period, traces reviewed, and a written decision with the next review date. Reverse the step if the edit rate climbs after a model change.
Is human in the loop always required?
No, and gating every call trains people to click yes. Require it for writes, irreversible steps and anything regulated; auto-allow safe read-only tools; and show the exact tool and arguments on every approval that remains.
What does the EU AI Act say about human oversight of agents?
Article 14 requires high-risk systems to be designed so overseers understand the limits, stay aware of automation bias, can decide not to use the output, and can intervene or stop the system. After the Digital Omnibus those obligations apply to Annex III uses from 2 Dec 2027, and the Article 50 duty to tell people they are dealing with an AI system has applied since 2 Aug 2026.
More in What is an AI agent?
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- Levels of Autonomy for AI Agents (arXiv 2506.12469)
- The agentic AI security scoping matrix
- AI Red Teaming Agent (Microsoft Foundry)
- A practical guide to building agents (PDF)
- Building effective agents
- How we built our multi-agent research system
- Multi-agent patterns (Strands Agents)
- Microsoft Agent Framework 1.0
- Durable Extension (Microsoft Agent Framework)
- Agent Development Kit (adk.dev)
- Harnesses in Copilot Studio
- Agent flows overview (Copilot Studio)
- Choosing a workflow type (AWS Step Functions)
- Build multi-step applications and AI workflows with AWS Lambda durable functions
- Human in the loop (OpenAI Agents SDK)
- Interrupts (LangGraph)
- Agents Rule of Two: a practical approach to AI agent security
- Frontier Risk Report, February to March 2026
- OWASP Top 10 for Agentic Applications for 2026
- The lethal trifecta for AI agents
- Article 14: Human oversight (EU AI Act tracker)
- EU Digital Omnibus on AI enters into force
- Over 40% of agentic AI projects will be scrapped by 2027, Gartner says
- Tool approval (Microsoft Agent Framework)
- Model Context Protocol tool (Microsoft Foundry Agent Service)
- Multistage and AI approvals (Copilot Studio agent flows)
- Policy for Amazon Bedrock AgentCore generally available
- AgentCore harness
- AgentCore Runtime versioning and endpoints
- Tool confirmation (Google ADK)
- Gemini Enterprise Agent Platform release notes
- Manage agents in Foundry Control Plane
- Agent actions in the Microsoft 365 admin center
- Disable agent identities (Microsoft Entra Agent ID)
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner