Progressive autonomy: a maturity model for agent deployment

This is part of our work on agentic AI, the condition that changes how all seven pillarspillarA responsible-AI principle as something an organization actively holds rather than merely endorses: one of the seven pillars of responsible AI, one per principle. A pillar is held, not implemented, by naming the harms that would breach the principle, assessing their risk, and placing controls that reduce it. Distinct from agentic AI, which is not one of the seven but a condition that changes how all of them are governed. See principle, harm, risk, agentic AI.Open full entry → of responsible AIresponsible AIThe set of principles an AI system should live up to: fairness, safety and reliability, privacy, security and robustness, transparency and explainability, accountability, and human oversight. Widely shared and sitting under the EU AI Act and the major frameworks. On their own the principles are statements of intent; the law turns them into duties that cannot be met unless they are carried inside the organization's governance, which is how responsible AI lands in governance rather than beside it. The seven principles are organized into seven pillars, one pillar per principle. See principle, pillar, governance. The seventh principle carries two names in practice: human oversight in the seven-pillar model, and human-centricity in the IAPP AIGP body of knowledge; the substance overlaps.Open full entry → are governed.

Why autonomy should be earned, not granted

The most common agentic governanceagentic governanceGoverning the actions an autonomous AI system takes, not just the decisions it makes; ensuring those actions can be contained, traced, and reversed.Open full entry → failure is over-relianceover-relianceGranting an agent more autonomy than its demonstrated reliability justifies, usually on the strength of a demo. The most common agentic governance failure.Open full entry →: an organization grants an agent more autonomy than its demonstrated reliability justifies, usually because the agent performed well in a demo. Demo performance is the agentic equivalent of a pre-deployment biasbiasA systematic skew in data, model behavior, or outcomes that treats one group differently from another without justification. Bias usually enters through training data that reflects historical patterns. For high-risk AI systems, Article 10 of the EU AI Act requires examination of datasets for possible biases and measures to detect, prevent, and mitigate them. See fairness, proxy discrimination.Open full entry → test that is never repeated. It tells you the agent worked once, on a known input, in a controlled setting. It tells you nothing about how it behaves across the live distribution of inputs, over time, in combination with other agents.

Progressive autonomyprogressive autonomyGranting an agent the least autonomy that lets it work, then widening its scope only as evidence of reliable behavior accumulates. Autonomy is earned, not configured.Open full entry → treats autonomy as something an agent earns through evidenceevidenceThe concrete proof that a control is designed, implemented, and working: a test report, an audit trail, an impact assessment, a monitoring log. Each link in the governance chain produces an artifact, and together they are what an organization hands to its own board, a regulator, a customer, or an affected person to show, not say, that a system is governed. Its absence is itself the failure: a risk register without test results, or a mitigation claimed without validation, is a governance gap, not a paperwork one. The closing link of the governance chain. See control, governance.Open full entry →, not something it is granted by configuration. The agent starts with a narrow scope and low-consequence actions, operates under close observation, and is given wider scope only when the evidence supports it. This is the same logic as the pillar maturity ladder, where an pillar moves from preventive-only to fully governed as more controlcontrolThe concrete, testable measure that reduces a specific risk, and through that risk protects the principle behind it. Also called a risk management measure, risk response, or risk treatment. Always traceable to the risk it addresses: under EU AI Act Art. 9 every control must map back to a specific risk, and controls recorded separately from their risks is a recognized compliance failure. It works in one of three types: preventive, detective, or corrective. See risk, control types, evidence.Open full entry → layers come into operation. Applied to agents, it becomes a deployment discipline.

Three dimensions of autonomy

Autonomy is not one quantity. It is useful to track an agent along three dimensions, because an agent can be advanced on one and restricted on another.

Decision authoritydecision authorityA dimension of an agent's autonomy: how consequential the decisions it may make are, from recommending to a human to deciding and acting without review.Open full entry → is how consequential the decisions the agent is permitted to make are. At the low end, the agent recommends and a human decides. At the high end, the agent decides and acts without review.

Process autonomyprocess autonomyA dimension of an agent's autonomy: how much of a multi-step process it runs without a human checkpoint, from a single step to an end-to-end workflow.Open full entry → is how much of a multi-step process the agent runs without a human checkpoint. At the low end, the agent completes one step and hands back. At the high end, the agent runs an entire workflow, including invoking sub-agentssub-agentAn agent invoked by another agent or an orchestrator to carry out part of a task. Its actions still inherit the obligations of the stack it belongs to.Open full entry →, end to end.

Accountability scopeaccountability scopeA dimension of an agent's autonomy: how far the consequences of its actions reach, from internal and reversible to customer-facing, hard to reverse, and legally weighty.Open full entry → is how far the consequences of the agent's actions reach. At the low end, actions are internal, reversible, and low-value. At the high end, actions affect customers, are hard to reverse, and carry legal or financial weight.

A well-governed deployment is explicit about where each agent sits on all three dimensions, and moves an agent along a dimension only when the controls for the next level are in place and the evidence justifies it.

A four-level model

Level one, assisted. The agent recommends; a human reviews and executes every action. Decision authority, process autonomy, and accountabilityaccountabilityThe principle that a named human or organization answers for an AI system's outcomes, through ownership, documentation, audit trails and redress; never the system itself. The EU AI Act attaches obligations to the role rather than the technology, with provider duties in Article 16 and deployer duties in Article 26, supported by technical documentation (Article 11) and record-keeping (Article 12). See provider, deployer, record-keeping, responsible AI.Open full entry → scope are all low. Required controls: action logging, a clear human decision point, and a documented scope. This is where every high-consequence agent should start.

Level two, supervised. The agent executes low-consequence actions autonomously but escalates anything above a defined threshold to a human. Process autonomy rises; decision authority and accountability scope stay bounded. Required controls: escalation triggersescalation triggerA rule that hands a high-consequence action to a human before it executes. The corrective control that keeps human oversight meaningful once per-action review is impossible.Open full entry →, behavioral monitoring against an expected envelope, and the ability to halt the agent.

Level three, bounded autonomous. The agent runs full workflows within a defined boundary, including invoking sub-agents, and a human is on the loop rather than in it. Required controls: action-level logging across the chain, driftdriftThe gradual divergence of an AI system's behavior or performance from its validated state after deployment, without any code change or error. Drift is silent by nature: nothing breaks, accuracy simply decays until someone measures it. Causes are worth separating: a shift in the mix of incoming cases, a change in the source material, a change in surrounding systems, or an update to the underlying model by its provider. See model drift, agent drift.Open full entry → detection, circuit breakers, rollback capability where the domain allows, and a tested incident process. This is the level at which the EU AI ActEU AI ActRegulation (EU) 2024/1689, the European Union's law on artificial intelligence. It takes a risk-based approach: prohibited practices, requirements for high-risk AI systems, transparency obligations for specific uses, and a separate regime for general-purpose AI models. Obligations are divided between providers and deployers. See general-purpose AI, conformity assessment.Open full entry →'s high-riskriskIn the EU AI Act's terms, the combination of the likelihood that a harm occurs and the severity of it if it does. The link between a principle (via the harm that would breach it) and a control (the measure that reduces it). Naming the harm and assessing its risk is required by Art. 9 before any mitigation measure is chosen. See harm, control, residual risk.Open full entry → obligations bite hardest, because the system now materially influences decisions without per-action human review.

Level four, cross-agent managed. Multiple agents operate as a managed system, with a governancegovernanceThe system through which an organization steers itself: corporate governance, risk management, compliance, lines of accountability, risk appetite, and the operating model. It exists across everything the organization does, before and beyond AI. AI governance is this same system extended for AI. See AI governance, governance design, execution level.Open full entry → view across the whole, attention allocated to the weakest agent, and the agentic estate run as a living management system. This is the agentic analogue of the ISO/IEC 42001ISO/IEC 42001The international requirements standard for AI management systems, published in 2023 and certifiable. It defines how an organization establishes, implements, maintains, and continually improves a management system for AI. Certification against ISO/IEC 42001 does not create a legal presumption of conformity with the EU AI Act. See AI management system, harmonized standard.Open full entry → management-system maturity that the seven-pillar framework points to.

How to use the model

For each agent in your inventory, place it on the three dimensions and the four levels, and confirm that the controls required for its level are designed, implemented, and evidenced. An agent operating at level three with only level-one controls is the agentic equivalent of an pillar governed by preventive controls alone: it looks capable in a demo and fails silently in production.

The discipline is to make autonomy a decision that is documented, controlled, and revisited, not a default that creeps upward as the team grows comfortable with the agent. Comfort is not evidence. The agent earns its next level by demonstrating reliable behavior under monitoring, and the organization grants it deliberately, with the controls for that level already in place.