How much should you trust an AI agent? A 4-level autonomy model

Short answer: "Can you trust the agent?" is the wrong question. The real one is: "which action, under which conditions, and how much?" A layered trust model answers that — and it belongs in code, not in a prompt.

Why isn't a prompt rule enough?

You can write "never send email without approval" into the system prompt — but a prompt isn't a security boundary. A web page the agent reads, an email, or a document can slip in a contradicting instruction (this is called prompt injection). Security has to sit somewhere the model can't be talked out of it: the tool-call layer.

The layered model: 4 questions on every tool call

1. Is the capability on? Is this tool family (read / write) enabled for this workspace?
2. Is the target on the list? Is the email domain, HTTP target, DB target on the allow-list? If not, don't run it — no matter how "convinced" the agent is.
3. What's the risk class? The same tool is a different risk with different arguments: adding an event to your own calendar ≠ sending an email to a customer.
4. Is the autonomy threshold exceeded? Based on the level the user chose, either run it or drop to approval.

The 4 levels in practice

• Supervised: only reading/drafting runs automatically. The right start for the first week.
• Low / High trust: medium-risk work gets automated; critical ones stay approval-gated.
• Autonomous: everything runs on its own — except the "never silent" class: actions you can't take back, or that touch your reputation (like posting to social media), still ask for approval at every level.

Trust, made measurable

This model comes with a useful side effect: everything can be audited. Every decision — ran, asked for approval, or denied — is logged, so "what did the agent do?" has an answer that's a record, not a guess. See how it works in SemAgent: AI Agent · autonomy guide · Trust Center.