Give an agent autonomy in steps, not all at once. A four rung ladder works well: observe, suggest, act with approval, act and report. Move up only when written evidence shows the agent is reliable at the current rung, and move down at once after a defined trigger such as a serious error.
The four rungs
Rung 0: observe. The agent reads and logs what it would do. Nothing is shown to users. Good for measuring on live data.
Rung 1: suggest. The agent proposes and a person acts. The agent has no write access.
Rung 2: act with approval. The agent can act after a person approves the specific action. Write access exists but is gated.
Rung 3: act and report. The agent acts on its own within bounds and reports afterward. Reserve this for reversible, low impact actions.
Not every action needs to climb. An agent can sit at rung 3 for tagging tickets and rung 1 for closing accounts.
Promotion criteria, written down
Before a promotion, agree the evidence. Examples:
- Accuracy. Proposed actions matched what a reviewer would have done in a stated share of a stated sample, over a stated period. Pick the numbers with your team; do not borrow someone else's.
- Severity of mistakes. Mistakes found were minor and reversible.
- Adversarial results. Hostile content did not change behavior across repeated tests.
- Coverage. The sample included hard and unusual cases, not just easy ones.
- Operational readiness. Logging, stop and rollback were tested.
Record the evidence in the promotion decision, along with who signed it.
Demotion triggers
Decide in advance what sends an agent back down:
- A mistake with real impact.
- A model, tool or data change that has not been re-tested.
- A drop in measured accuracy.
- A security finding.
Demotion should be easy and not seen as failure. A kill switch that nobody dares use is not a control.
Pair rungs with controls
| Rung | Minimum controls |
|---|---|
| 0 | Read only access, logs |
| 1 | Read only access, review of suggestions |
| 2 | Scoped write access, approval detail, rate limits |
| 3 | Narrow scope, reversible only, alerts, spend caps |
Worked example
A ticket triage agent starts at rung 0 for two weeks, comparing its labels with human labels. It moves to rung 1, showing a suggested label. After review of its suggestions shows steady agreement, it moves to rung 3 for labels only, since labels are reversible. Assigning tickets to people stays at rung 2.
Where Safeguard fits
Safeguard's policies, gates and guardrails can encode what an agent may do at each rung, and agent identity helps you change scope per agent.
Quick check
Can an agent be at different rungs for different actions?
Yes. Set the rung per action type, by risk and reversibility.
What should force a demotion?
A high impact mistake, an untested model or tool change, a drop in measured accuracy or a security finding.
Last reviewed: 19 October 2026.
