Why write access ends up as a default
Almost nobody decides how much autonomy an agent should have. It gets inherited. Someone builds a read only assistant, it works, a service account gets a broader token so a demo can update a record, and six weeks later that token is in production doing writes nobody approved. The register says the organisation has four agents. The identity provider says fourteen service principals are calling model endpoints. Autonomy is a decision that deserves a document, and most organisations have never made it explicitly, which is a different problem from access control. Access control answers which systems an agent can reach. Autonomy answers how far it may go once it's there, and with whose permission. Work through the six steps below and you'll finish with a written level per agent, an enforcement point, and a record you can hand to an auditor.
Step 1. Inventory what is already acting
Start from identity, not from the project list, because the project list is always shorter than reality. Pull every non human identity that has called a model endpoint or an internal API on behalf of a model in the last 90 days. Cross reference against your agent register. The delta is your shadow autonomy, and on a first pass it's usually two to three times the registered count. Outcome to verify: a single list where every acting identity has a named human owner and a business purpose in one sentence. Any identity you cannot attribute to an owner gets disabled, not investigated. If it mattered, someone will be in touch within a day, and that is a cheaper discovery method than a spreadsheet exercise.
Step 2. Sort actions by reversibility, not by risk score
Risk scores invite argument because they compress too much into one number. Reversibility does not. For each action an agent can take, ask one question: if this fires wrongly at 3am, how do we undo it, and how long does that take? Reading a document is free to undo. Writing to a scratch table is a delete. Sending an email to a customer is an apology. Moving money, changing an entitlement, or filing something with a regulator is not undoable at all. Outcome to verify: every action the agent can reach is placed in one of four buckets, reversible instantly, reversible with effort, socially costly, or irreversible. You'll find the argument disappears once people stop debating severity and start debating recovery time.
Step 3. Assign one of four autonomy levels
Four levels are enough, and more than four gets ignored in practice. Level 0, suggest only: the agent produces output, a human acts. Level 1, act on approval: the agent prepares the action and a named human confirms before it executes. Level 2, act and notify: the agent executes and a human sees it in a queue with an undo window, typically 15 minutes to an hour. Level 3, act autonomously: execution with periodic sampled review rather than per action review. Map the levels to the reversibility buckets from step 2 and the assignment mostly writes itself. Irreversible actions cap at level 1, full stop, no matter how good the eval numbers are. Outcome to verify: a one page table with every agent, its level, and the specific reversibility bucket that justifies the level. If a level cannot be justified by a bucket, it was set by enthusiasm.
Step 4. Put the level somewhere it is enforced
A level written in a policy document and nowhere else is a wish. The level has to live at a control point the agent cannot route around, which in most architectures means the layer that issues credentials or the layer that brokers tool calls, not the prompt. Prompt level restrictions are guidance to a probabilistic system, and treating them as controls is the single most common design error in agent deployments. Practical form: the agent's identity carries a scope that permits only the actions at or below its level, and anything above requires a token that only an approval flow can mint. Outcome to verify: attempt a level 3 action with a level 1 agent in a test environment and confirm it fails closed, with the refusal recorded. Until you have watched that refusal happen, you have documentation rather than enforcement.
Step 5. Make oversight something a person can actually do
Level 1 and level 2 both depend on a human, and this is where these designs quietly fail. If approvals arrive faster than a person can read them, they get rubber stamped, and you have level 3 wearing a level 1 badge. Set a throughput budget: how many approvals per hour can this reviewer genuinely assess, and what happens when the queue exceeds it. The honest answers are throttle the agent or raise the level deliberately, and the dishonest answer is to say nothing and let the reviewer approve in bulk. The EU AI Act frames this in Article 14 as oversight a person can effectively exercise, and Article 26 puts the duty on the deployer to assign it to someone competent with the authority to act. Outcome to verify: measured approval latency and approval rate over two weeks. An approval rate above 98 percent with sub five second latency means nobody is reading.
Step 6. Review levels on a schedule and after every model change
An autonomy level is a judgement about a specific system on a specific model version against a specific data source. Change any of the three and the judgement is stale. Tie a review to model version upgrades, since vendors will ship them whether or not you're ready, and to a fixed quarterly cadence for everything else. Levels should move in both directions. An agent with six months of clean sampled review at level 2 has earned a case for level 3, and refusing to ever promote is how organisations end up with reviewers who stop looking. Outcome to verify: a dated review record per agent showing the level, the evidence considered, and the decision. That record is the same artefact an ISO 42001 internal audit will ask for and the same one that lets you tell a board how much of your AI runs unsupervised, which is a question more boards are starting to ask. If you want help setting the first levels against the workflows that actually matter, the Free AI Value & Readiness Assessment covers it.