The Autonomy Dial

'How much autonomy should the agent have' is the wrong question — too coarse. Build an autonomy matrix: risk of the action × reversibility.

• Read-only actions: free rein. search, get, list — no checkpoint needed.
• Reversible writes: auto-approve with logging. draft, create_temp, stage_change.
• Irreversible or expensive: gated. send, pay, delete, publish — a human signs off.

The dial turns per tool, and it can turn per user, per tenant, per run. The mistake is picking one autonomy level for everything — you either gate so much the agent is a form, or gate so little it's a liability.