The three terms describe who decides and who acts. Assisted remediation suggests a fix and a person applies it. Automated remediation applies a predefined fix when a rule matches. Autonomous remediation also chooses the fix and opens the change itself, usually with a human approval step you can tighten or loosen.
Definitions in one table
| Level | Who finds the fix | Who applies it | Who approves the merge |
|---|---|---|---|
| Assisted | Tool suggests | Developer | Developer and reviewer |
| Automated | A fixed rule | Bot, on a trigger | Reviewer, or a rule |
| Autonomous | Tool decides per finding | Tool opens the pull request | Set per category, from manual to automatic |
The vendor marketing around these words is loose, so ask what a tool does when nobody is watching. That single question separates the levels better than the label does.
Why the difference matters for risk
An assisted tool cannot break your build on its own, because a person types the change. An automated rule is predictable: it does the same thing every time, so you can test it. An autonomous system makes choices, so you need to understand its limits, its approval controls and how it records what it did.
More autonomy is not a goal by itself. A team with thin test coverage may be better served at the assisted level for months. A team with strong checks and small, frequent releases can reasonably let low risk categories move faster.
How to pick a level per change type
Do not choose one level for the whole organisation. Choose per category of change:
- Patch level dependency bumps with passing required checks are the usual first candidate for more autonomy.
- Minor and major bumps, code edits and configuration changes stay on manual approval longer.
- Anything that touches authentication, payments or data handling keeps a named human approver.
The approval tiers by change type post goes deeper on this split.
What to ask a vendor
- Can I turn every autonomous action off, and is that the default?
- Is there an approval step I can set per category?
- What evidence does each change carry, and where is the audit record kept?
- How do I pause everything quickly?
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a proposed fix is presented to the reviewer before anything merges.
Where Safeguard fits
Safeguard's autonomous remediation can open fix pull requests with the evidence a reviewer needs. It is off by default and every category starts on Manual, so you decide what earns more autonomy. You can try a free scan to see what it would find.
Quick check
Is autonomous the same as unattended?
No. Autonomous describes who chooses and prepares the change. Approval can still be manual for every category.
Which level should a new team start with?
Start where a person approves every change, then widen one category at a time as acceptance and revert numbers support it.
Last reviewed: 19 October 2026.
