Autonomy is not a switch, it is a dial set per action type. Risk-tier by reversibility and audience, start where a mistake is cheap, and earn the next level with evidence rather than a meeting.
The question 'should we let the AI act on its own?' has no useful answer, because it treats acting as one thing. Updating a stage on an internal record and sending an email to a customer's CFO are both actions. They share almost nothing that matters.
The useful version is per action type, and it has three settings rather than two.
Three levels, per action type
- Recommend — the system states what it would do and why. A human executes. Nothing changes without a person doing it.
- Approve — the system prepares the action completely: the drafted message, the field change, the routing decision. One click ships it.
- Autonomous — the system executes within a policy, and the record of what it did is the notification.
The middle level does most of the work in practice, and it is the one most implementations skip. Recommend leaves all the effort with the human, so it saves attention but not time. Autonomous is where the anxiety lives. Approve removes the labour while keeping the judgement, which is exactly the trade most revenue teams actually want.
Tier by reversibility and audience
The two dimensions that determine risk are how easily an action can be undone, and who sees it if it is wrong.
- Reversible and internal — a stage correction, a field enrichment, a re-score. Cheapest possible mistake. Start here.
- Reversible and external — an internal Slack notification about a customer, a task assigned to a colleague. A mistake is visible but recoverable.
- Irreversible and internal — deleting a record, merging accounts, changing a closed-won amount. Rare, and rarely worth automating.
- Irreversible and external — an email to a customer, a quote, a calendar invite to an executive. This is the tier that produces incidents, and the one where Approve should stay the ceiling for a long time.
Rank actions by what a mistake costs, not by how impressive the automation looks in a demo.
The only tiering rule that survives a real incident
Blast-radius controls belong in the pilot
The instinct is to pilot on a small group and add controls before scaling. That gets it backwards: the controls are what make the pilot informative, because without them a pilot cannot tell you what would have happened at scale.
The minimum set:
- Scope — which accounts, segments and owners the system may act on at all.
- Rate limits — per action type, per hour and per account, so a bad rule cannot fan out.
- Novelty gates — an action pattern never seen before drops a tier automatically until reviewed.
- A kill switch that a non-engineer can find and use, tested before launch rather than during the incident.
- Dry-run mode — the system logs what it would have done without doing it, which is how you measure a tier before granting it.
Promotion earns its way; demotion is automatic
Moving an action type from Approve to Autonomous should require evidence, not a decision meeting: a stated volume of approvals, an approval rate above a threshold, and no correction pattern in the audit log.
Demotion should not require anything. If the approval rate for an action type falls below its threshold, or corrections cluster, the tier drops automatically and someone is told why. A system that can only be made more autonomous by hand and less autonomous by hand will only ever move in one direction, because the meeting to reduce autonomy is one nobody schedules.
The audit log is the product
Teams build the audit log for compliance and then discover it is the most useful surface in the system. Every entry should answer: what was done, to what, by which policy, on what evidence, who approved it, and what the state was before.
With that, a question like 'why did this account get three emails last week' has a two-minute answer instead of a two-day investigation. Without it, every anomaly becomes an argument about whether the system did something, before anyone can discuss whether it should have.
Where teams actually start
The reliable opening position is Autonomous for reversible internal actions, Approve for everything customer-facing, and Recommend for anything touching pricing, contracts or executive relationships. That configuration produces almost all of the available time savings while keeping every consequential decision with a person.
Teams that start there and tighten based on their own audit log end up more autonomous within two quarters than teams that started aggressively, because they never had the incident that freezes a programme for six months.