Agent autonomy is earned per task, not granted

The question I get asked most about running an autonomous agent is some version of "how much do you let it do without you." People want a dial, a single setting from cautious to hands-off. I don't have one, because the honest answer is that autonomy is a property of the task, not the agent, and the same agent operates at wildly different levels depending on what it's doing.

I run three levels, and the useful thing is that they're assigned per task type, not set globally. Consult: the agent presents options and waits, no action without a decision from me. Propose: the agent recommends a specific action and proceeds once I approve. Execute: the agent acts and reports what it did, and I audit periodically rather than gating each one. A single agent doing a morning's work might be at Execute for drafting research, Propose for anything that changes a priority, and Consult for a call with real strategic weight. Collapsing that into one system-wide setting is how you end up either bottlenecking everything through approval or letting the agent run on things it has no business deciding alone.

The default for anything new is Propose. Not Execute, even when I suspect the agent could handle it, because Propose is the level where I find out whether it actually can, cheaply, before the cost of being wrong is a merged change instead of a rejected suggestion. And crucially, graduation is earned on evidence, not granted on a good feeling. To move a task type from Propose to Execute, the bar is concrete: the agent has demonstrated the right action across several tasks of that type, I've been approving its recommendations without modifying them, and the errors it does make are reversible and low-impact. If I'm consistently editing what it proposes before approving, it hasn't earned Execute. Those edits are the system telling me it isn't ready. The approval-without-modification streak is the actual signal. A vaguer "it seems reliable now" is exactly the judgement that talks you into over-trusting a system right before it embarrasses you.

Two things make this more than a bureaucratic ceremony. The first is that graduation is per task type, so trust is specific rather than global. The agent earning Execute on research doesn't earn it on governance changes. Each task type accumulates its own track record, and a strong record in one says nothing about a different kind of work with different failure modes. This is deliberately narrow, because the tempting move, "it's been great lately, let it off the leash generally," is how a good record on easy work becomes unearned latitude on hard work.

The second is a hard floor that overrides all of it. There's a category of work, the security-sensitive slice, auth, secrets, access control, that stops for human review no matter what autonomy level the task would otherwise carry. An agent at Execute for a task type still stops when that task touches the floor. The autonomy ladder governs the normal case; the floor governs the case where being wrong is expensive and invisible, and the floor wins. Keeping those two mechanisms separate matters, because it means I can grant genuine autonomy on the broad, reversible middle of the work without that autonomy ever quietly extending to the places it shouldn't reach.

What this buys, and why I think most people set it up backwards, is that it turns me from a bottleneck into an exception handler. If autonomy were one global dial, I'd be choosing between reviewing everything (and being the constraint on my own system) or reviewing nothing (and owning whatever it does unsupervised). Per-task graduation lets the broad, safe, reversible majority of the work run at Execute while my attention concentrates on the genuine judgement calls and the security floor. The scarce resource in an autonomous system is my review attention, not the model's capability, and the entire design is about spending that attention on the decisions that actually need a human, not on rubber-stamping work the agent has already proven it does well. You get there by making the agent earn each rung, on evidence, one task type at a time.