The question is usually asked backwards
Teams putting AI into an operation tend to ask, "How much can we let it do?" The question sounds practical, but it measures the wrong thing. It anchors on the model's capability — how good it is — when the variable that should govern authority is how much damage a wrong action would cause.
A system can be highly capable and still be a poor candidate for autonomy if the consequence of a rare error is severe. Conversely, a modest system can be trusted to act on its own where mistakes are cheap and reversible. Capability and consequence are different axes, and it is consequence that must set the bound.
Autonomy as a ladder, not a switch
Autonomy is not on or off. It is a ladder, and an action can sit on a different rung than the one beside it. The rungs run from offering advice a human must accept, through acting only after approval, to acting within explicit bounds and reporting — with a human able to intervene at any point.
Autonomy proportional to consequence
- Advice only The system informs; a person decides and acts.
- Proposed action The system proposes; a person reviews and executes.
- Approval-gated action The system prepares, and acts only after human approval.
- Bounded autonomous action The system acts within explicit limits, monitored, with recovery.
- Continuous autonomy Only for observable, reversible, low-consequence behavior with proven recovery.
The practical move is to place each action — not each system — on a rung. A single operation will span several: it can draft and retrieve on its own, must pause for a person before a consequential change, and may run a routine, reversible step within set limits.
How to place an action
Three questions decide the rung. How reversible is the action if it is wrong? How large is the harm if it is wrong and not caught? And how confident, in a calibrated sense, is the system about this specific case? Low reversibility or high harm pulls the action up the ladder toward human authority, regardless of how capable the model is on average.
Confidence matters, but only as a modifier and only when it is calibrated. An overconfident system is more dangerous than a cautious one, because it claims authority it has not earned. Where confidence is low, the action should move up a rung — to a human — rather than proceed.
Each rung has a cost of admission
Granting a rung is not free. Each level of autonomy has controls it must carry before it is allowed:
- Advice and draft. Grounding in retrieved sources and citations, so a human can check the reasoning.
- Act after approval. A clear approval gate, a complete record of what was proposed and by whom it was approved, and an easy path to reject.
- Act within bounds. Explicit limits, monitoring against those limits, and automatic escalation when a case falls outside them.
- Every rung. An append-only audit trail, the ability for a human to intervene, and evaluation that is repeated, not performed once.
Where this is realized
This is not only a position. In the Governed Case Operations System, the approval gate is a named state, and authority is tiered by consequence: low-consequence steps run within bounds, consequential ones stop for a human, and the most consequential require senior approval. The governed AI blueprint generalizes the same control boundary.
Limitations
This is a method, not a measurement. It argues how to decide authority; it does not claim a specific error rate or outcome for any system. Classifying an action's consequence is itself a judgment that must be made with the operation's owners and revisited as the operation changes.