How much should you trust an AI agent? A 4-level autonomy model

Short answer: "Can you trust the agent?" is the wrong question. The right one: "which action, under which conditions, how much can you trust?" A layered trust model answers it — and that model must live not in the prompt but in code.

Why isn't a prompt rule enough?

You can write "never send email without approval" into the system prompt — but a prompt is not a security boundary. A web page the agent reads, an email, a document can inject a contrary instruction (prompt injection). Security has to stand where the model can't be talked out of it: at the tool-call layer.

The layered model: 4 questions on every tool call

1. Is the capability on? Is this tool family (read / write) enabled for this workspace?
2. Is the target on the list? Is the email domain, HTTP target, DB target on the allow-list? If not, don't run it — no matter how "convinced" the agent is.
3. What's the risk class? The same tool is a different risk with different arguments: adding an event to your own calendar ≠ sending an email to a customer.
4. Is the autonomy threshold exceeded? Based on the level the user chose, either run it or drop to approval.

The 4 levels in practice

• Supervised: only reading/drafting runs automatically. The right start for the first week.
• Low / High trust: medium-risk work gets automated; critical ones stay approval-gated.
• Autonomous: everything is automatic — except the "never silent" class: irreversible/reputational actions such as publishing to social media ask for approval at every level.

Trust, made measurable

The by-product of this model is auditability: every decision (ran / asked for approval / denied) is logged. The answer to "what did the agent do?" is not a feeling but a record. For the implementation in SemAgent: AI Agent · autonomy guide · Trust Center.