The Autonomy Ladder
Six levels of AI autonomy over enterprise systems, each defined by what must be true before a system may operate there, plus the actions that must never become autonomous and the questions to ask a vendor claiming a level.
Version 0.1, draft, published 2026-08-11. Six levels, defined by what a customer can audit rather than by what a vendor can demonstrate.
BvLogic operates NOTHING on this ladder above Level 0, and no customer system is connected to us. This specification is published before the product rather than alongside it, deliberately: an autonomy framework written by the party that already sells the autonomy is worth less than one written before there is anything to defend. When we do operate at a level, this page will say which, on which systems, and who signed it off.
Why entry conditions rather than capabilities
Every autonomous-IT proposal reaches the same wall. A regulated enterprise cannot grant autonomy it cannot bound, and 'the AI asks permission when it matters' is not a bound, because it leaves the system deciding what matters. So the levels below are defined by what must be TRUE BEFORE a system may operate at them, not by how capable the system claims to be. Capability is what a vendor demonstrates; entry conditions are what a customer can audit.
| Level | Name | What it means |
|---|---|---|
| 0 | Observe | The system reads telemetry and presents it. It offers no diagnosis and proposes no action. |
| 1 | Recommend | The system diagnoses and proposes a specific action. A human decides and a human executes. |
| 2 | Assisted | The system executes, but a human approves each action individually before it runs. |
| 3 | Policy autonomous | The system executes without asking, but only actions that fall inside a written policy envelope agreed in advance. |
| 4 | Closed loop | The system detects, acts, and verifies its own result without a human in the loop for that cycle. |
| 5 | Strategic | The system identifies opportunities across the estate and prepares strategic options for a human decision. |
A level without a scope is marketing
The single most common misuse is level inflation by scope. A system that resolves password resets automatically is described as Level 4, which is true for password resets and false for the estate. A level is only meaningful with a named scope attached: 'Level 3 for non-production Kubernetes workloads' is a claim; 'Level 3' alone is marketing.
The levels
Level 0
Observe
The system reads telemetry and presents it. It offers no diagnosis and proposes no action.
What must be true before operating here. Read-only credentials, scoped to the systems in the stated scope. An audit record of every read.
Reversibility. Nothing to reverse. Reads can still leak, so the access itself is the control.
Who is accountable. The engineer who granted the credential.
How this level gets claimed without being earned. Presenting a dashboard as autonomy. Observation is the baseline capability of a monitoring tool and has been for thirty years; describing it as an autonomy level at all is generous.
Never at this level. Read access to systems outside the stated scope, on the argument that more context produces better answers.
Level 1
Recommend
The system diagnoses and proposes a specific action. A human decides and a human executes.
What must be true before operating here. Every recommendation must carry its evidence and the query that produced it, so the human can check the reasoning rather than the conclusion.
Reversibility. Fully. Nothing has been done.
Who is accountable. The human who acts, who owns the outcome exactly as if they had diagnosed it themselves.
How this level gets claimed without being earned. Recommendations written with enough confidence that checking them feels redundant. A recommendation a human cannot practically verify is an instruction with extra steps, and the accountability transfer is fiction.
Never at this level. Presenting a recommendation without its evidence. That is the difference between this level and the appearance of it.
Level 2
Assisted
The system executes, but a human approves each action individually before it runs.
What must be true before operating here. The approval request must state the action, the blast radius, and what happens if it goes wrong. Approval must be refusable without penalty to the operator.
Reversibility. Required. An action offered for approval must have a stated rollback, or it must be escalated rather than approved.
Who is accountable. The approver.
How this level gets claimed without being earned. Approval fatigue engineered into consent. A system that asks four hundred times a day is not obtaining approval; it is training the operator to click. Measure the approval-to-rejection ratio: if nothing is ever rejected, this is Level 3 wearing a Level 2 badge.
Never at this level. Bundling several actions behind one approval, or defaulting the approval to yes on timeout.
Level 3
Policy autonomous
The system executes without asking, but only actions that fall inside a written policy envelope agreed in advance.
What must be true before operating here. A policy document naming permitted actions, permitted targets, time windows, and rate limits. Every action outside it must fail closed rather than escalate silently. The envelope must be reviewed on a stated cadence.
Reversibility. Every action in the envelope must be individually reversible, and the rollback must have been executed in a test at least once. An untested rollback is a hope.
Who is accountable. The person who signed the policy envelope, by name, with a date.
How this level gets claimed without being earned. An envelope written so broadly that nothing falls outside it. 'The system may take any action required to restore service' is not a policy; it is Level 4 with a signature on it. A real envelope can be read aloud and produce disagreement.
Never at this level. Widening the envelope automatically because an action was blocked. The block is the system working.
Level 4
Closed loop
The system detects, acts, and verifies its own result without a human in the loop for that cycle.
What must be true before operating here. Everything Level 3 requires, plus a verification step that can fail, plus a bounded blast radius per cycle, plus an automatic stop when a stated number of consecutive cycles fail. A loop that cannot stop itself is not closed, it is unattended.
Reversibility. Required, and the rollback must itself be inside the loop rather than a human runbook. If recovery needs a human at 3am, the loop was never closed.
Who is accountable. Named owner of the loop, plus a stated review of every cycle it ran, read by a human on a stated cadence.
How this level gets claimed without being earned. Verification that checks the action completed rather than that the problem is gone. Restarting a service and confirming the service restarted proves nothing about the incident. Verification must test the symptom, not the remedy.
Never at this level. Operating a closed loop on a system whose rollback has not been exercised in production conditions, and never on identity, entitlements or anything a customer's auditor treats as a control.
Level 5
Strategic
The system identifies opportunities across the estate and prepares strategic options for a human decision.
What must be true before operating here. Options must be presented with what would have to be true for each to be wrong. Cost and benefit figures must cite their source or declare that they are estimates and on what basis.
Reversibility. Not applicable. Nothing is executed at this level.
Who is accountable. The executive who decides. The system's role ends at the recommendation.
How this level gets claimed without being earned. Numbering this level 5 implies it is the most autonomous, and it is not: it executes nothing. It sits at the top because the decisions are the largest, not because the machine is freest. A vendor claiming Level 5 while operating at Level 1 on the estate is describing a slide, not a system.
Never at this level. Presenting a projected saving as a measured one. This is the level where an invented figure does the most financial damage, because it is read by the person who can act on it.
Actions that must never rise above Level 2
Regardless of maturity, track record, or how well the system has performed elsewhere. The common property is that the cost of being wrong is not recoverable by a rollback, and rollback is the control every level above 2 depends on.
- Changing identity, entitlements or access control. The blast radius of an entitlement error is every system at once, and the error can grant itself persistence.
- Deleting data, or any action whose rollback depends on a backup that has not been restored in a test.
- Financial commitment: purchasing, renewing, or terminating a contract.
- Anything a regulator or auditor treats as a control, because the evidence of who decided is the control.
- Containment actions that disconnect production systems, unless the scope is a single named non-production environment.
- Anything affecting physical or personal safety.
- Communicating with a customer, a regulator or the public on the organisation's behalf.
This list is the part of the specification worth arguing with first. If your organisation would move an item off it, the reasoning for doing so is exactly the reasoning an auditor will ask for later, so it is worth writing down at the time rather than reconstructing it.
Questions to ask a vendor claiming a level
Questions rather than a score, because a score invites the vendor to optimise for the score. Each of these has a wrong answer that is easy to give and hard to defend.
- At what level, on exactly which systems, and with what scope written down?
- Show me the policy envelope. Can two of your engineers read it and disagree about whether an action is permitted?
- When did you last execute the rollback in production conditions, not in a test environment?
- What is your approval-to-rejection ratio, and if nothing is ever rejected, what is the approval for?
- What does your verification test: that the action completed, or that the symptom is gone?
- How does the loop stop itself, and how many consecutive failures does that take?
- Which of your figures are measured and which are projected, and where is the source for each?
Status
Version 0.1, draft. One organisation publishing a specification is a proposal. It becomes a standard when somebody who does not work here operates against it and disagrees with a level definition. Disagreement is the useful outcome, and this page will record it.
Everything here is free and stays free. There is no form in front of any document. If you want to know when new guides and templates go up, leave an email.
Roughly monthly. Unsubscribe in one click. We do not share your address, and we will not call you.