How do you decide what an agent is allowed to do autonomously?
Draw the line at reversibility and blast radius. Actions that are reversible and bounded — reading, drafting, staging — run autonomously. Actions that are irreversible, outward-facing, or expensive require explicit confirmation. This is a policy decision that belongs to the business, encoded in the tool dispatch layer rather than in a prompt.
Encoding it in the prompt is the common mistake. Prompts are advisory; a policy-aware dispatch layer that refuses to execute an unapproved tool call is enforcement.
Make the boundary visible to users. An agent that says what it did and what it is waiting for permission to do earns considerably more latitude than one that acts silently.
Revisit the line as the eval scores improve. Autonomy is something a system should earn against measured reliability on a specific action class, not something granted wholesale at launch.
Written by Binary AI Labs · Reviewed