Graduated autonomy for AI agents: permissions that are earned and revoked

From binary access to graduated trust

AI agents that can query data, open tickets, or execute changes are often deployed with one of two models: full access or read-only access. The first increases their usefulness but also increases the impact of a bad decision. The second reduces risk while sharply limiting the tasks an agent can complete. In a proposal published by AWS, Dev Arora, Meera Kezhukoot, and Sathish Kumar Prabakaran describe a third option: graduated autonomy.

The idea is to treat trust as an operational state that changes with observed behavior. An agent starts with limited permissions, gains additional capabilities after demonstrating sustained performance, and immediately moves down when risk signals appear. This does not claim that the model is reliable by itself. It is a way to design the environment so authorization depends on evidence and can be revoked.

Six layers for controlling the loop

The described architecture separates six responsibilities. A scoring engine calculates a trust level from accuracy, safety, consistency, compliance, and efficiency. A tier system translates that score into four levels: probation, supervised, trusted, and autonomous. The proposal uses a rolling window of 50 actions and keeps safety as an independent floor, so strong efficiency results cannot offset dangerous behavior.

New agents start at the most restrictive level. Promotions require the score to remain above the threshold for the full window; demotions can happen immediately. Hysteresis, with an extra margin for promotion, prevents an agent from oscillating between two levels when its score is close to a boundary.

The third layer inspects every call before execution. It looks for injection indicators, secrets in arguments, destructive tools, deviations from the usual behavior pattern, overconfidence, and insufficient reasoning before an action. AWS emphasizes that these fast filters should not be the only defense. Application code can be wrong or manipulated.

That is why effective authorization sits outside the agent process. AgentCore Gateway can enforce Cedar policies with default denial and forbid rules that take precedence over permits. A promotion can therefore change the available capabilities without relying on the model to choose the correct behavior.

Evidence, recovery, and delivery

After each action, the system records the full path: reasoning, plan, applied policy, result, and effect on trust. Capturing the state before an action matters because it supports investigation and recovery when a change is wrong. To keep a modified version from going straight to production, changes to prompts, configuration, or tools pass through tests with ground-truth and adversarial cases. A single unauthorized tool call during those tests blocks delivery.

The pattern also proposes honeypot cases, an emergency stop, and a policy that reduces an agent’s capabilities to zero without a redeployment. In multi-agent systems, the effective level can be the minimum across the delegation chain, preventing one agent from gaining extra privilege through another.

The technical lesson is straightforward: securing an agent does not end with a prompt or a model provider. It requires identity, external policy enforcement, observability, continuous evaluation, and a recovery path. Graduated autonomy does not remove risk, but it turns a static permission decision into an operational loop that can measure, constrain, and correct behavior.