The conditions for agent autonomy

We talk about agent autonomy as if it's a switch. It isn't. It's a set of conditions that have to hold before a human can genuinely hand over the reins, and most of the discussion fixates on the wrong one. Everyone wants to talk about guardrails. Far fewer people want to talk about judgment, which is the condition that actually determines whether you trust the thing.

Three layers have to resolve together: judgment, guardrails, and liability. Let me take them in that order, because that's the order of difficulty.

Figure 1. The three conditions for agent autonomy.

Layer one: judgment, or the tolerance condition

Give an agent a mandate and it will hold to it with a literalism no human would. Tell it to buy at a set price and it will walk away from a deal that's five dollars over, even when that deal is plainly good for you. Technically it obeyed. Practically it failed.

Humans don't operate on hard thresholds. We overlay a band of tolerance on every decision, a sense of when the spirit of the instruction beats the letter of it. A mandate stripped of that band isn't a faithful copy of our intent, it's a brittle caricature of it. And an agent that executes the caricature will frustrate the very trust it needs to earn.

So the real question for agent design isn't how tightly we can specify a mandate. It's whether marginal judgment should be baked in, and who gets to set the width of the band. This is the condition people underweight, and it's the one that makes autonomy feel like autonomy rather than a vending machine.

Layer two: guardrails, or the safety condition

Judgment can't run unbounded, which is where guardrails come in. But they aren't one thing, they're two.

Global, server-side guardrails are the platform's responsibility: the hard limits that keep every user safe, applied regardless of any individual mandate. These are non-negotiable and they sit above the agent.

Personal mandate guardrails are the user's own preferences and limits, the things you set for your agent specifically. This is where the tolerance band from layer one lives.

The relationship between the two matters. Tolerance operates inside the mandate layer. It can flex a personal preference, but it can never override a global guardrail. A grace band is permission to be sensible, not permission to be unsafe.

Figure 2. The grace band sits inside the personal mandate and stops well short of the global guardrail.

Layer three: liability, or the accountability condition

Here's the honest state of play: no jurisdiction has a purpose-built regime for delegated authority to AI agents. But the law isn't starting from nothing, and this is where it gets interesting.

Courts are reaching for old agency doctrine, the body of law that already governs when one party acts on another's behalf. It distinguishes express authority, granted through explicit settings and permission toggles, from implied authority, the discretion a reasonable principal expects their agent to exercise through the ordinary course of dealing. Read that again, because it's the tolerance band, already named in law. The grace period isn't a loophole, it's implied authority.

On validity, we're actually settled. ESIGN established years ago that a contract isn't void just because an electronic agent formed it, provided the action is attributable to the person being bound. So machine-made deals hold. What's unsettled is allocation: who pays when the agent gets it wrong. The AI AGENT Act introduced in 2026 forces platforms to allow delegation and to log agent actions, but it is conspicuously silent on liability. The cleanest principle on offer comes from banking: the consumer isn't liable where the agent exceeds its delegated authority, and the platform is liable where it controlled the delegation and failed to enforce it.

The parallel already on the road

We've run this experiment before, with cars. The SAE autonomy levels are really a map of one question: when is the human still on the hook. At Level 2, the system drives but you must monitor and intervene, so you remain responsible. At Level 4, the vehicle handles everything with no human in the loop.

Tesla's current product is called Full Self-Driving (Supervised), which is almost an oxymoron, and that tension is the whole story. It's Level 2 precisely because Tesla keeps the driver legally responsible. The grace band is contested, because the agent acts but the human owns the outcome.

The Cybercab is the other pole. When Tesla self-certified its robotaxi as Level 4 in Texas, it absorbed the operational liability. By declaring there's no supervising human, it accepted that responsibility relocates to the manufacturer and the software developer. Remove the human from the loop and liability doesn't disappear, it moves to whoever built and deployed the autonomy. The courts are already pricing this in: a jury assigned Tesla a share of fault in a crash case, and a federal judge upheld a $243 million verdict in early 2026.

Figure 3. Commerce agents sit near the supervised end of the autonomy spectrum.

That's the whole arc in one image. A commerce agent taking a deal five dollars off mandate is a Level 2 car. It's acting on its own, but no one has agreed who's responsible when the judgment call goes wrong. We already have a working model for full delegation, the Cybercab. We just haven't built it for agents yet.

A note on rigor: meaningful human control

It's worth grounding this in work that predates the current wave. Researchers studying automated driving converged on a framework of meaningful human control resting on two conditions, tracking and tracing.

Those two conditions are, almost exactly, layers one and three of this piece. Tracking is the judgment condition stated formally, the agent faithfully reflecting human intent. Tracing is the liability condition stated formally, a responsible human standing behind the system. The fact that an entirely separate field arrived at the same structure is a good sign we're carving the problem at its joints.

The conditions, together

These layers are interdependent, and that's the point. Judgment without guardrails is reckless. Guardrails without a liability regime are unenforceable. And liability without a theory of judgment punishes the wrong party, usually the human, for a call the agent was always going to have to make.

Autonomy doesn't become trustworthy when the technology gets good enough. It becomes trustworthy when all three conditions resolve at once. Until then, every agent we deploy is a supervised one, whatever we choose to call it.

‍