How much autonomy should you give an AI agent?
As much as the risk of the task allows, and no more. There's no single right answer — the useful way to see it is a ladder, using a coding agent as the example: write the code, review the code, write the tests, push the code, merge to main. At each rung you decide whether a human still needs to sign off. The autonomy question isn't 'how smart is the agent,' it's 'how much does it cost if this step is wrong.'
Here is the ladder, using a coding-copilot example.
1. Write the code
The lowest-stakes rung. The agent drafts, you do everything else. Almost always safe to hand off.
2. Review the code
Now it’s checking work, not just producing it. Useful, and still low risk, because a human is downstream.
3. Write the tests
The agent decides what “correct” looks like. A bit more trust, because bad tests can hide real bugs.
4. Push the code
It’s now taking an action with consequences outside its own sandbox. This is usually where teams start wanting a human checkpoint.
5. Merge to main
Full autonomy. The agent ships to the shared codebase with no one in between. The warning that comes with it: if you automate this entire chain and something breaks, you need to be able to trace back through every step to find where and why. No logging, no checkpoints, and you can’t.
Why it matters
High-risk or regulated work earns a human in the loop; low-risk work doesn’t. Put the checkpoints where the risk is, not everywhere and not nowhere.
From the conversation
This explainer is drawn from these episodes — each carries its full transcript.
