What is graduated autonomy for AI agents?

What are the L1–L4 autonomy levels?

The rubric defines four tiers by a single question: what is the agent allowed to do without a human? Each level up moves one responsibility from the human to the agent — first the reasoning, then the drafting, then the execution, then the decision to execute at all.

L1 — Suggest: the agent observes signal and recommends. It writes “here is the likely root cause and the command I would run,” and stops. The human does everything else. This is the safe default for any new skill.

L2 — Draft: the agent produces a concrete, reviewable artifact — a pull request, an infrastructure diff, a scoped runbook — but does not apply it. The human reviews a finished change instead of a paragraph of advice.

L3 — Execute-with-approval: the agent is ready to act and pauses at an explicit approval gate. A human clicks approve; the agent then executes inside a sandbox with scoped, task-time credentials and writes a tamper-evident receipt. This is where MTTR starts dropping meaningfully.

L4 — Autonomous: within a pre-defined guardrail — a specific skill, a bounded blast radius, a set of reversible actions — the agent detects, decides, and executes without a per-event human approval. The human moves onto the loop, reviewing outcomes and adjusting guardrails, rather than in it approving every step.

• L1 · Suggest — Agent recommends; human does everything. The zero-risk starting tier.
• L2 · Draft — Agent produces a reviewable diff or PR; human applies it.
• L3 · Execute-with-approval — Agent executes on human approval, inside a sandbox with scoped credentials.
• L4 · Autonomous — Agent acts within a bounded guardrail; human reviews outcomes, not every step.

Why model it on self-driving levels?

The autonomous-vehicle industry did not ship “full self-driving” on day one. It defined the SAE L0–L5 scale so that a car could advertise exactly which tasks it owned and which the driver still had to. Cloud-ops agents need the same shared vocabulary — otherwise “autonomous agent” means nothing and buys no trust.

The parallel is precise. In a car, L2 keeps a human hands-on the wheel; L3 lets the human disengage under specific conditions but be ready to take over; L4 drives itself inside a defined operational domain. For a cloud agent, the “operational domain” is a specific skill and a bounded set of reversible actions. Nobody promotes a car to L4 on the highway before it can park itself, and nobody should promote an agent to autonomous incident response before it has proven itself at execute-with-approval.

The point of a named rubric is accountability. When a level is explicit, a team can ask the honest question — “which skills are at L3, and what would it take to promote them to L4?” — instead of arguing about whether an agent is “trustworthy” in the abstract.

Why does graduated autonomy matter in 2026?

In 2026 the question is no longer “can an AI agent act in production?” — it demonstrably can. The question is “how much, and how do we grant that safely?” Graduated autonomy is the answer that lets a team capture the MTTR win without betting the environment on an all-or-nothing switch.

Two failure modes dominate without a tiered model. The first is over-caution: teams keep every agent at L1 forever, so the agent is a fancy suggestion box and MTTR never moves. The second is over-reach: a team wires an agent straight to production credentials with no gate, and one hallucinated command becomes an outage. Graduated autonomy is the middle path — you promote per skill, per environment, as evidence accumulates.

It also gives compliance and leadership a legible control surface. “All incident-triage skills are L4 in staging and L3 in production; all data-deletion skills are capped at L2” is an auditable policy. A binary “the agent is autonomous” is not.

How does graduated autonomy relate to the DARV loop?

CloudThinker runs production operations through the DARV loop — Detect, Analyze, Remediate, Verify. Graduated autonomy sets how much of that loop a given skill closes without a human. The autonomy level is applied at the Remediate step; Detect, Analyze, and Verify run the same at every tier.

Detect and Analyze are shared across all levels — the agent always investigates. The tier decides what happens at Remediate: at L1 it only proposes a remediation, at L2 it drafts the change, at L3 it pauses for approval before applying, and at L4 it applies within the guardrail. Verify always runs afterward, and its result feeds the promotion decision — a skill that closes the loop cleanly at L3 for weeks becomes a candidate for L4.

This is why autonomy on CloudThinker is safe to grant: it rides on brokered per-task identity, credentials issued at task time, sandboxed execution where the credential lives in the environment rather than the prompt, deterministic data tokenization at egress, and tamper-evident audit. Those production-side controls are what let an L4 skill act without a human standing over it.

The graduated autonomy rubric at a glance

One row per tier. Each level moves exactly one responsibility from the human to the agent.

How to promote an agent up the autonomy tiers

Autonomy is earned per skill, not declared for the platform. The promotion path is deliberate and reversible.

1. Step 1

   Start every skill at L1

   A new skill lands at Suggest. It watches real incidents and writes what it would do. You compare its recommendation to what the on-call engineer actually did. Zero production risk, maximum learning signal.

2. Step 2

   Promote to L2/L3 once the recommendations hold

   When the agent’s suggestions consistently match the correct action, move it to Draft (it opens the PR) and then to Execute-with-approval (it applies on a click). Every action runs in a sandbox with scoped, task-time credentials and leaves a tamper-evident receipt.

3. Step 3

   Graduate to L4 inside a bounded guardrail

   Once a skill closes the DARV loop cleanly at L3 over many incidents, promote it to Autonomous for a specific, reversible action class and environment. Cap high-blast-radius skills below L4 by policy. Any level is reversible — a bad outcome demotes the skill instantly.

Frequently asked questions

What are the levels of graduated autonomy for AI agents?

There are four tiers. L1 (Suggest): the agent recommends and the human does everything. L2 (Draft): the agent produces a reviewable change like a pull request or diff, and the human applies it. L3 (Execute-with-approval): the agent executes on explicit human approval, inside a sandbox with scoped credentials. L4 (Autonomous): the agent detects, decides, and executes within a bounded guardrail while a human reviews outcomes rather than every step.

How is graduated autonomy different from the SAE self-driving levels?

It is the same idea applied to software agents instead of cars. The SAE L0–L5 scale defines exactly which driving tasks the car owns at each level; graduated autonomy defines which operational tasks an AI agent owns at each level. The key difference is that a cloud agent’s “operational domain” is a specific skill and a bounded set of reversible actions, so autonomy is granted per capability rather than per vehicle.

Why not just let an AI agent run fully autonomously?

Because trust is earned per capability, not granted wholesale. An all-or-nothing switch forces a choice between an agent that never acts (no MTTR benefit) and an agent wired to production with no gate (one bad command becomes an outage). Graduated autonomy lets you promote each skill as evidence accumulates, and demote it instantly if an outcome is wrong.

How does CloudThinker implement graduated autonomy?

Each agent skill on CloudThinker carries an autonomy level applied at the Remediate step of the DARV loop. New skills start at L1 and are promoted toward L4 only as they close the loop cleanly. Every action above L1 runs under brokered per-task identity, credentials issued at task time, sandboxed execution, deterministic data tokenization at egress, and tamper-evident audit — the controls that make autonomous action safe to grant.

Can different autonomy levels apply to different environments?

Yes — that is the point of a tiered policy. A common pattern is a skill running at L4 in staging but capped at L3 in production, or high-blast-radius actions like data deletion capped at L2 everywhere. Because the level is a per-skill, per-environment setting, teams get an auditable, legible control surface instead of a single binary “the agent is autonomous.”