Autonomy tiers for AI coding agents: when can an agent finish without review?
Every agent fleet has one governance question that matters more than the rest: when may an agent finish something without a human looking at it? Answer too cautiously and nothing ships without permission. Answer too loosely and broken or irreversible work goes out silently.
This describes a routing design that answers the question mechanically. It comes from a kanban-driven fleet worked by one operator and running daily since March 2026. It is one reasonable design, not the only one.
Step 1: classify the action, not the tool
Two questions: can it be undone locally, and can it affect anyone besides the operator?
- Category A, reversible-local: no gate. Edits inside the working tree, read-only queries, commits to your own main branch, calls to local services.
- Category B, irreversible-local: route to review at any tier. Deleting untracked files, dropping or truncating tables, force-pushing, deleting agent state without a backup. The action may run, but the work never auto-completes.
- Category C, external-effect: confirm first. Messages to other people, outside invites, purchases, third-party webhooks, deploys to infrastructure you do not run. The agent blocks the item and names the confirmation it needs.
- Hard-blocked: bulk deletes, privilege escalation, process-killing commands, writes to system directories.
Classify by who is affected. A notification to the operator is category A; the identical call to another recipient is category C. An outside API tool that fetches is a different row from the same tool when it submits.
Step 2: earn a tier per project
- Tier 1, supervised: everything goes to review. This is the default for new projects, and also what you get when the tier is missing or the lookup fails. An outage in governance should fail toward review.
- Tier 2, trusted: non-code work may auto-complete; code only at confidence 8 or higher with passing checks.
- Tier 3, autonomous: standard pass rules, still subject to category B.
A script computes the tier from history. Tier 2 needs at least 10 completed items and a rework rate of about 10 percent or less; tier 3 needs 30 and about 5 percent or less. Rework means an item sent back from review to working, which is a human disagreeing with the agent. Projects with external effects are capped at tier 2, because a perfect internal record does not make autonomous external writes survivable.
Step 3: treat confidence as advisory
Agents report a 1-to-10 score, with each level anchored (10 is automated proof, 8 is tests pass and the changed path was exercised, below 6 goes to a human). But tier and confidence only establish eligibility. Permission needs deterministic evidence: a verification command that exits zero, or a diff matching the declared file list. A 10 with neither still routes to review. If your only rule is "the agent said 9," you have built a polite rubber stamp.
Step 4: a short routing list
The first match wins, with review rules first:
1. Tier is 1, missing or unknown: review. 2. Any category B action: review. 3. A review tag, or a policy or governance title: review. 4. A behavior change, at any size: review. 5. Non-behavior and under about 20 lines: continue. 6. No deterministic evidence: review. 7. Otherwise: complete.
Be strict about behavior. Editing a script or a prompt file is behavior, because one line in an agent's instructions changes everything after it. Size never overrides this.
Standing exceptions
If a category C action is exactly what you want unattended, do not loosen the category. Write an exception that is named, dated and attributed, scoped by exclusion (every other project still needs confirmation), and recorded where agents read.
Honest limits
Only the hard-block list is enforced by tool configuration; the rest is reference text and routing logic. The fleet is small and single-operator.
Going further
The thresholds, the routing decision list and a copyable policy config are in chapter one of the Agency Playbook.
This article was written with AI assistance.