DefinitionGoverned autonomy · 3 levelsVersion 1.025 October 2026
Governed autonomy: how much an AI agent may do alone
Governed autonomy is the rule under which an AI agent acts within permissions set by the risk of each step of a workflow, records every action and keeps a stop at hand, and moves from assistance to supervised execution, then to bounded autonomy, only when the record of its past actions supports the change. This page sets out the 3 levels, why the risk of the step sets the level, the evidence that raises or lowers it, and what stays human.
On this page
Autonomy is not the product. Governed autonomy is.
In this page, "we" means Hikari Blue, which engineers and operates the AI operating layer that connects models, data, and business workflows. The 3 levels are those of our Enterprise AI Agents offer and its implementation guide, published on 23 October 2026.
An agent under governed autonomy already runs under its own identity, a declared tool scope and a stop path. Governed autonomy decides how far it may act alone inside that scope, step by step.
The identity every agent runs under, before any level applies: AI agent identity
The stop every level keeps at hand: AI kill switch
3 levels: assistance, supervised execution, bounded autonomy.
Each level says what the agent does and what your people keep. The level belongs to a step of the workflow, not to the agent.
| Level | The agent | Your people | Typical steps |
|---|---|---|---|
| 1 · Assistance | Prepares. A person acts. | Decide and execute. | Drafting a proposal, summarizing a file, suggesting a match. |
| 2 · Supervised execution | Acts once a person approves. | Approve at the gate, with the context in front of them. | Sending a quote, preparing a payment, posting an entry above a threshold. |
| 3 · Bounded autonomy | Acts alone, within limits you set. | Set the limits, review the record, stop it at any time. | Updating the CRM, matching below a threshold, routing an exception. |
The levels, their wording and their typical steps are those of the Enterprise AI Agents offer and of section 4 of its implementation guide. Every action is recorded at every level, and the stop path stays available at every level.
The same table, in the implementation guide: Autonomy, step by step
The risk of the step sets the level, not the agent.
Autonomy is a setting per step, not a property of the agent. The level follows the risk of each step: the higher the risk, the closer the human decision.
One agent, 3 levels
The same agent can draft a proposal at level 1, prepare a payment at level 2 and update the CRM at level 3, inside one workflow.
Set before anything is built
Each step of the workflow receives an autonomy level before anything is built. The threshold is fixed before deployment, not discovered after an incident.
Approved by the named owner
The named owner of the workflow approves the level of each step, and answers for the agent, its scope and its level of autonomy.
Proportionate to the risk
In our reading, this follows Article 14(3) of the EU AI Act, under which oversight measures are commensurate with the risks, level of autonomy and context of use of a high-risk system.
Who approves the level: Named owner
A level rises on the record and can fall at any time.
The level rises at an operating review, on the evidence of the record, and can be lowered at any time.
Raising a level
An agent moves up a level only when its record supports it for that step. The decision is taken at an operating review, with the named owner, on the record of past actions: human interventions, incidents and time to stop.
Lowering a level
The level can be lowered at any time, without waiting for a review. Lowering a level takes nothing away from the record or the stop path.
The texts that set the oversight, in our reading.
Mapping prepared by Hikari Blue; the European Commission, NIST and OWASP have not reviewed it.
| Text | What the text writes | In our reading, where it lands |
|---|---|---|
| EU AI Act, Article 14(4)(d) | The persons assigned to oversight can decide, in any particular situation, not to use the system or to disregard, override or reverse its output. | The approval gate of level 2, and the right to lower a level. |
| EU AI Act, Article 14(4)(e) | They can intervene in the operation of the system or interrupt it through a stop button or a similar procedure that allows it to come to a halt in a safe state. | The stop path, kept at every level. |
| EU AI Act, Article 26(2) | Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support. | The named person who approves at the gate and decides a change of level. |
| NIST AI 100-1, GOVERN 1.6 | Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities. | The agent register, with the level of each step. |
| NIST AI 100-1, MANAGE 2.4 | Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use. | Lowering a level, and the stop. |
| OWASP Top 10 for Agentic Applications for 2026 | ASI03 Identity and Privilege Abuse, ASI09 Human-Agent Trust Exploitation and ASI10 Rogue Agents, among 10 risks published on 9 December 2025. | Permissions bound to the step, a person who reads the context before approving, and a level that falls on a signal. |
Standards. NIST’s Center for AI Standards and Innovation (CAISI) announced the AI Agent Standards Initiative on 17 February 2026, for industry-led standards and open protocols for AI agents, with research on agent authentication and identity. We cite it as context, not as a source of the 3 levels.
Scope. Articles 14 and 26 of the AI Act bind high-risk systems, from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems, since Regulation (EU) 2026/1744. The Act does not use the word agent. NIST AI 100-1 is voluntary.
This is not legal advice. Whether a system is high-risk, and which role an organization holds for it, is a question for counsel.
What stays human, at every level.
Nothing that moves money or commits the company leaves without a named person's decision. Payment files are prepared by an agent, never released by one.
Releasing, signing, committing
The agent prepares; a named person releases, signs or commits.
Setting the limits
At level 3, your people set the limits, review the record and can stop the agent at any time.
Changing a level
No agent raises its own level. A named person decides, on the record, and the record keeps the decision.
The questions asked about governed autonomy.
What is governed autonomy for AI agents?
Governed autonomy is the rule under which an AI agent acts within permissions set by the risk of each step of a workflow, records every action and keeps a stop at hand, and moves from assistance to supervised execution, then to bounded autonomy, only when the record of its past actions supports the change.
What are the 3 levels of autonomy for an AI agent?
Assistance: the agent prepares and a person acts. Supervised execution: the agent acts once a person approves. Bounded autonomy: the agent acts alone, within limits you set, while your people review the record and can stop it at any time.
Who decides the autonomy level of a step?
The named owner of the workflow, on the risk of the step. Each step receives a level before anything is built; the level rises at an operating review, on the evidence of the record, and can be lowered at any time.
What does the EU AI Act say about agent autonomy?
The Act does not use the word agent. For high-risk systems, Article 14(3) makes oversight measures commensurate with the risks, level of autonomy and context of use, and Article 14(4)(d) and (e) let the persons assigned to oversight override the output or stop the system. In our reading, the 3 levels are how a deployer sets that oversight step by step.
Can an AI agent release a payment under governed autonomy?
No. Nothing that moves money or commits the company leaves without a named person's decision. Payment files are prepared by an agent, never released by one.
Reference documents and primary sources.
Every article and date on this page comes from the sources below, read on 25 October 2026.
Reference documents
- What is an AI operating layer? The definition, the 4 tests for buyers and the regulated-grade standard.
- Glossary of the AI operating layer Every term of the AI operating layer, each in one standalone sentence with its sources.
- Enterprise AI Agents The offer: agents engineered into your workflows, under governed autonomy, measured on your operations.
- Enterprise AI agents implementation, phase by phase The guide: phases, controls and the 3 autonomy levels, step by step.
- Agentic AI, governed for production The definition: what an agent is, and what makes it governable.
- Named owner The person, recorded by name, who answers for one AI use.
- AI agent identity Why every agent acts under its own revocable identity.
- AI kill switch The way to stop: a stop path built into the layer, timed from T0 to T4.
- Regulated-grade The working standard: 4 requirements, applied in every sector, not a certification.
Primary sources, consulted on 25 October 2026
- EUR-Lex · Regulation (EU) 2024/1689, the AI Act, consolidated text (opens in a new tab) Version of 27 July 2026. Articles 14 and 26. A documentation tool without legal effect.
- Official Journal · Regulation (EU) 2026/1744, Digital Omnibus on AI (opens in a new tab) Published on 24 July 2026. Application dates of the high-risk obligations.
- NIST AI 100-1 · AI Risk Management Framework (AI RMF 1.0) (opens in a new tab) NIST, January 2023. GOVERN 1.6 and MANAGE 2.4. Voluntary.
- OWASP GenAI Security Project · Top 10 for Agentic Applications for 2026 (opens in a new tab) Published on 9 December 2025. Risks ASI01 to ASI10.
- NIST CAISI · AI Agent Standards Initiative (opens in a new tab) Announced on 17 February 2026: industry-led standards, open protocols, agent identity research.
How to cite this document.
This URL is permanent and always serves the current version. Each change of substance increments the version and is listed in the changelog below, so a citation stays traceable to the text it quoted.
Preferred citation
Hikari Blue, "Governed autonomy: how much an AI agent may do alone", Glossary of the AI operating layer, v1.0, 25 October 2026, https://hikariblue.com/glossary/governed-autonomy
Section anchors are stable: #definition, #levels, #risk, #evidence, #human, #faq, #references, #cite.
Changelog
v1.0 · 25 October 2026. First public version.
License. Published under CC BY 4.0: free to cite, quote and reuse with attribution to Hikari Blue and a link to this page. The license covers Hikari Blue’s text, tables and diagrams on this page; it does not cover third-party data, quotations or legal texts, which keep their own terms, nor the Hikari Blue name and logo, trademarks of UNITED4 LLC.
Set the autonomy level of each step of one workflow.
30 minutes with a named partner. We take one workflow you run today and mark, step by step, what an agent could prepare, what it could do once approved and what it could do alone, with the evidence each level would need. You leave with that map, whether or not we work together.
- One workflow, mapped step by step
- The level each step allows, and why
- The evidence each level would need