Skip to main content
Every agent has an autonomy level. It is the single user-owned control for how far the agent acts without a person, and it is read in three places: the automation engine, the tool-call gate, and the sandbox.

​
What each level sets

The level maps to an engine policy rather than being interpreted ad hoc: autopilot does not remove the confidence floor; it lowers it. An agent on autopilot still declines to close a conversation it is not reasonably sure about.

​
Setting it

Autonomy lives on the agent, in metadata.autonomy:
An unrecognised value does not fail — it silently becomes suggest. So "autonomy": "manual", "off" or a typo does not put the agent in draft; it puts the agent in the middle setting, sending replies and running lookups on its own. Read the value back after setting it, and treat “the dial did nothing” as evidence the value was rejected rather than applied.
Read it back to confirm it took:
Response

​
How a tool is judged money-moving

Under suggest, the confirmation gate fires for money-moving and irreversible tools. A tool qualifies if it is on the platform’s canonical destructive-tool list, or if its name classifies as financial, destructive or bulk. Read tools never qualify. Classification is by substring on the tool name:
A custom tool whose name matches none of these is treated as not money-moving. void_invoice contains no listed pattern, so under the default suggest level it runs with no confirmation — the gate never sees it as risky. If you register your own tools, either name them so they classify (cancel_invoice, refund_order) or put the agent on draft, where every non-read tool is gated regardless of its name.
On autopilot the host-side gate is off, but the sandbox’s own policy gate still runs. Autopilot means “no confirmation prompts”, not “no guardrails” — and if you want a proof that each call was authorized rather than a policy check you have to trust, put an Agent Gate in front of the tool server.

​
Choosing a level

Start on draft while you are still reading what the agent writes. Move to suggest once its replies are ones you would have sent — that is the level most teams stay on, and the money-moving gate is what makes it safe to. Reach for autopilot only where a wrong action is cheap to reverse, or where an Agent Gate is proving each call.

​
Next steps

ResponseCX platform

The platform this control governs.

Rules quickstart

Hard constraints, for behaviour no autonomy level should permit.

Agent Gate

Requiring a verified proof before a tool call runs.

Workflow Studio

Where the engine policy this sets is published from.