There are two ways to get this wrong, and almost everybody picks one of them.
The first is to approve everything. It feels responsible for about nine days, and then the approvals queue becomes a second inbox nobody reads, and things get rubber-stamped at 4:55pm. An approval you do not actually read is not a control; it is a log entry that makes you feel supervised.
The second is to turn everything on. That works until the first genuinely strange week — a tracking break, a viral post, a holiday — and then you find out what your agent does with an assumption that has quietly stopped being true.
The useful answer is in between, and it has a shape.
Sort actions by what a mistake costs
Not by how clever the action is. By the cost of getting it wrong, and by how quickly you can undo it.
Reading costs nothing. Pulling yesterday's metrics, checking whether the pixel fired, reading Search Console. Nobody should be approving a read. Requiring it trains people to click approve without looking, which is the actual damage.
Low-risk writes are cheap and reversible. Pausing an obviously broken ad, drafting a post, renaming something, adding a note. A mistake here costs minutes and one click to undo.
High-risk writes move money or speak in public. Raising a budget, launching a campaign, publishing to your audience. These are the ones worth a human, and the reason is not that the agent is bad at them — it is that the recovery is expensive and sometimes impossible.
Once actions are sorted this way, "how much autonomy" stops being one dial and becomes a small number of independent decisions. You can let reads run free, let low-risk writes act unattended, and keep budget changes in an inbox — a combination no single slider can express.
The floor is not part of the ladder
Here is the distinction that took us longest to get right, and it is the one that matters most.
Autonomy decides who approves an action. Guardrails decide whether the action is permitted at all. They are not two settings on the same axis, and collapsing them is how systems end up with a guardrail that a permission level can switch off.
A spend cap, a ROAS floor, a geography rule, a blocked creative angle — these are a floor. Nothing above them can lower them. Moving an agent to autopilot on a risk tier changes who signs off on what the tier already allowed; it never widens the tier, and it can never talk past the cap. That is enforced where the action executes rather than in a prompt, because a prompt is a request and an executor is a gate.
Earn it one tier at a time
The sane rollout is boring:
- Start at approve-everything for anything that writes. Watch the inbox for a few weeks.
- Notice which approvals you always approve. That is the tier that has earned autonomy — you are not deciding anything, you are acknowledging.
- Move exactly that tier to unattended. Leave the rest.
- Watch what changed. Then consider one more.
The signal to move a tier is that you have stopped reading its cards, which is also the signal that supervision has stopped working. Either promote it or start reading again; doing neither is the failure mode.
Unattended still means visible
An action that runs without approval is not an action that happened in secret. It should land in a decision log — what changed, what the agent expected, and a way to reverse it. Ours records every agent change per entity and offers a one-click revert, gated so that reverting cannot itself break a guardrail. Alerts cover the rest: blocked actions, failed publishes, spend anomalies, measurement breaks.
The measure of a good setup is not how many approvals you clicked this week. It is whether you could explain, in one sentence, what your agent may do while you sleep — and then go and look at exactly what it did.
If you cannot answer that sentence today, that is the thing to fix, whatever tool you are using.