How do companies give AI agents more autonomy safely, with approvals before anything goes live?
Companies give AI agents more autonomy safely by treating it as a permission granted per type of action and raised on evidence, never switched on all at once. Agents start on drafts. Anything public, customer-facing, costly or irreversible waits for a named person. Spend is capped before the call is made, every action is recorded, and an agent moves up one step only when its approval record is clean and a person decides. Deleting data and changing governance should always wait.
What does autonomy mean for an AI agent?
Autonomy is how much an agent is allowed to do without a person in the loop. It is a design choice, separate from how capable the model is. A very capable agent can still run at low autonomy if it must check with a person before each action.
A useful public framework comes from researchers at the University of Washington, published by the Knight First Amendment Institute. It describes five levels by the role the user plays: operator, collaborator, consultant, approver and observer (Knight First Amendment Institute). At the low end the user directs every step. At the high end the agent acts and the user watches.
For a growth team, the practical version is narrower: which actions can this agent take on its own today, which ones wait, and what evidence would change that?
Why do agents with too much freedom go wrong?
OWASP's guidance on AI risks names the problem "excessive agency" and traces it to three root causes (OWASP):
Excessive functionality: the agent can reach tools it does not need.
Excessive permissions: the tools it uses have more access than the task requires.
Excessive autonomy: high-impact actions run without anyone checking them.
A hallucinated fact, a misread instruction or a prompt hidden in a web page becomes a real problem only when the agent can act on it. The controls below each close one of those three gaps.
What are the steps to raise autonomy safely?
1. List every action and rank it by risk. Write down what each agent can do, then sort it:
Reads and reports (lowest risk).
Drafts that nobody else sees yet.
Changes to shared records, such as a CRM stage or a content calendar.
Anything that leaves your workspace: an email to a contact, a message to a customer.
Anything public: a published page, post or ad going live.
Spending money, deleting data and changing who can approve what (highest risk).
2. Grant the fewest tools and the narrowest permissions. Connect only the apps the first job needs, and only the actions within them that the agent uses. An agent that drafts emails does not need permission to delete contacts.
3. Put the approval before the irreversible step. A sent email cannot be unsent, so review it while it is a draft. A good approval screen shows the action, what it targets, the inputs, the cost estimate, the risk and who may approve it.
4. Check spend before the call, not after the bill. Set daily and monthly caps per agent, a hard cap on each ad account, and a quote for any single expensive job such as a video render.
5. Record everything. Every action, approval, refusal and edit, with who decided and when, in a log nobody can edit after the fact.
6. Run on drafts for a set window. Thirty days is a sensible minimum for most marketing and sales actions. Measure the evidence described below.
7. Promote one step at a time, by a person. The system can nominate an agent for more room. A person with the right to do so decides. For the top level, require a second person.
8. Demote quickly. Too many refusals, an error or a spend breach should drop the agent a level automatically, without anyone having to notice first.
9. Keep a stop button. Any authorised person should be able to pause an agent at once.
Which actions should always wait for a person?
Some actions should never be earned, whatever the record says:
Deleting records, pages or files.
Changing permissions, approvers or the autonomy rules themselves.
Removing a page from search or redirecting it.
Spending above an agreed cap, or raising the cap.
Anything legal or contractual.
Salesforce's own AI acceptable use policy makes a similar point about high-stakes decisions needing a person to make the final call, as its Trailhead guidance on Agentforce guardrails explains.
How do the major platforms handle approvals today?
Checked 24 October 2026 on each vendor's own pages:
HubSpot Agent Hub: the Prospecting Agent offers two settings, "Review emails" and "Send without review" (HubSpot knowledge base). It is a per-agent switch rather than a ladder.
Salesforce Agentforce: guardrails are written as topics and instructions, with escalation to a person, and the Einstein Trust Layer adds toxicity detection, monitoring and an audit trail.
Lindy: its site says irreversible actions wait for your approval, and the FAQ says actions that write or send can wait (Lindy).
Relevance AI: its documentation lists human oversight and approval workflows, plus escalation protocols (Relevance AI docs).
Jasper: Jasper IQ includes controls, permissions and policies for content work (Jasper).
What most of these leave to you: the promotion rule. They tell you how to turn review on or off. They say less about what evidence should change it, who decides, and what makes an agent lose autonomy again.
What evidence shows an agent is ready for more?
Track these per agent and per action type, not per fleet:
Approved without edits. The share of drafts a person approves unchanged. This is the strongest single signal.
Refusals. How often a person dismisses the work outright. Almost none should be the bar.
Sample size. At least a few dozen decisions before you trust the rate.
Hand-ups. Did the agent pass risky or unclear calls to a person instead of guessing?
Breaches. Zero spend-cap breaches and zero errors over the window.
If the numbers hold for a month, raise one step. If they slip, drop one.
What failure modes should you plan for?
Rubber-stamp approvals. When the queue is long, people approve without reading. Fix: fewer, better-described approvals, and a daily review window.
Approvals in the wrong place. A separate tool nobody opens means work stalls. Fix: approve where the work is, and notify the person who holds the right.
Promotion by the calendar. "It has been three months" is not evidence. Fix: promote on the record, not on time.
Permission creep. Tools added for one task stay forever. Fix: review each agent's tools quarterly.
Spend leaks. Small charges across many agents add up. Fix: per-agent caps plus a workspace limit.
How does Nagent's earned autonomy work, and what does it not do?
We make Nagent, and earned autonomy is central to it. Nagent is multiplayer AI for growth: people and AI agents in one shared context, delivering the number. Every agent sits on a five-step ladder, explained on the team page and in autonomy and governance:
L1 Observe: reads and reports; anything it would write waits.
L2 Assist: drafts on its own; changes to records others rely on wait. Every agent starts here.
L3 Operate: changes workspace records on its own; anything reaching outside the workspace waits.
L4 Represent: acts outside the workspace, such as emailing a contact; publishing waits.
L5 Lead: publishes on its own and can hand work to agents below it.
How promotion works: the system nominates, a person decides, and no agent is promoted by the system. Nomination needs 30 days at the level, at least 25 decided cards and almost none dismissed. Levels rise one step at a time, and on Enterprise a raise to L5 needs a second person. A nightly re-read drops a level for too many dismissals, errors or thumbs-down.
How approvals work: held actions wait on a "Confirm before it runs" card in the team room and in the Inbox of everyone who may approve them, showing the action, inputs, cost estimate, risk and side effects. Typing "approve" in chat does not approve anything; only the buttons do. Budgets are checked before a paid call is made.
What it does not do: no level below L5 publishes on its own, so a person approves every customer-facing step below L5. Deleting and governance changes always wait for a person, even at L5. Plans set a ceiling: Solo and Team reach L3 Operate, Business L4 Represent and Enterprise L5 Lead (see /pricing). For the background, read what earned autonomy is or the earned autonomy ladder.
Frequently Asked Questions
How does Nagent's earned autonomy work for AI agents?
Agents start at L2 Assist on a five-step ladder. The system nominates an agent after 30 days, 25 or more decided cards and almost no dismissals; a person decides, one step at a time. A nightly check drops a level after too many dismissals or errors.
Should destructive actions ever run without human approval?
No. Deleting data, changing permissions or approval rules, and removing pages from search should wait for a person at every level. Spending above a cap should be refused or queued, never run.
Is there an AI outbound tool that drafts personalised emails but waits for approval before sending?
Yes. HubSpot's Prospecting Agent has a "Review emails" setting, and in Nagent an outreach email waits for a person until the agent reaches L4 Represent, which only a person can grant.
How do budget caps work for AI agents?
A cap is checked before each paid call. If the call would cross the agent's daily or monthly limit, it is refused or queued for approval, and the breach is recorded. A good setup also caps the ad account itself.
To walk through an approval ladder for your own team, book a demo.