Choosing the Right Autonomy Level
Autonomy is a dial, not a switch. Learn the GH-600 autonomy ladder, the guardrails required at each rung, and how to pick the right level for a given blast radius and reversibility.
Choosing the Right Autonomy Level
Autonomy is a dial. The exam tests whether you can name the rungs of the dial, the guardrails each rung requires, and the decision rule for picking a rung.
The autonomy ladder
| Level | Name | What the agent does | Required guardrails | | --- | --- | --- | --- | | 1 | Suggest | Produces text / diffs for a human to read. No side-effects. | Inspectable plan; trace ID; audit log. | | 2 | Review-gated | Creates reversible artifacts (PR, draft, branch). Human approves the irreversible step. | All of L1 + explicit approval gate; classified retry policy. | | 3 | Auto-apply (bounded) | Executes on its own within a narrow allow-list, on reversible primitives. | All of L2 + budget caps; blast-radius cap; one-command rollback; eval threshold gate. | | 4 | Fully autonomous | Plans, executes, and acts on irreversible primitives end-to-end. | All of L3 + automated rollback on regression; continuous evaluation; on-call paging on anomaly. |
Mantra: blast radius × reversibility drives the level. Model quality and user impatience do not.
The decision rule
if action is irreversible: require human approval (L2 or below)
elif blast radius is large: require L3 with eval gate + rollback
elif action is reversible + small: L3 auto-apply OK
elif read-only: L1 / L2 unconstrained
Per-action, not per-agent
A single agent can hold multiple autonomy levels. The agent that opens PRs may be L3 for commenting on issues, L2 for opening the PR, and L1 for deploying to production. Granularity at the tool level is the safe default.
Configure the dial
Autonomy dial
For each autonomy level, toggle the guardrails that must be in place before the agent is allowed to operate there.
Where this shows up on the exam
A common question shape is: "The team wants to remove the approval gate because the agent has been reliable. What do you tell them?" The right answer always names progressive, per-action promotion with eval thresholds and rollback — not "trust the agent" and not "keep the gate forever".
Key terms
- Autonomy level
- A classification of how much agency the agent has — from suggest-only, through human-review, to fully autonomous — paired with required guardrails.
- Reversibility
- How easily a side-effect can be undone. Highly reversible actions can tolerate higher autonomy; irreversible ones demand human review.
- Blast radius
- The set of resources affected if the action goes wrong. Larger blast radius forces lower autonomy.
- Human-in-the-loop
- A guardrail where a human approves the agent's plan before any side-effecting action runs. Required at higher autonomy levels for irreversible actions.
Common pitfalls
- Picking autonomy level by 'how smart the model feels' instead of by blast radius × reversibility. The model's quality does not change the cost of an outage.
- Letting autonomy ratchet up silently: the agent succeeds 100 times, someone removes the approval gate, and the 101st run is the one that breaks production.
- Using a single autonomy level for the whole agent. The right granularity is the *tool* or the *action*, not the agent.