An open standard
Right now "autonomous AI agent" means nothing. One vendor's agent writes an email you press send on. Another picks the recipients, writes the copy, sends it at 2am and files the result in your CRM. Both are sold with the same sentence. These are the six levels that tell them apart.
Buyers have no words for the difference, so they cannot ask for it, contract for it, or audit it. Operators have no words for it either, so they find out during an incident.
The six levels below borrow their shape from the SAE levels for self-driving cars, for the same reason those exist: the useful question is never whether something is automated. It is who is responsible when it is wrong, and how anyone would know.
We wrote this from running agents that send real email to real customers on behalf of real businesses. The failure modes named here are ones we caused.
Each level states what the agent may do, what a human still has to do, and the way that level characteristically fails.
Generates text. Touches nothing. You act.
Most products sold as "AI employees" today are L0 with a better interface.
Writes drafts into your systems. You commit each one.
The level you are actually at is the level a human is actually reviewing at.
Picks targets and composes. You approve each item.
Every approval needs an expiry after which it dies rather than fires.
Acts freely inside an envelope enforced in code.
An agent that never hits its bounds does not have bounds. It has decoration.
Owns a domain. Requires working detection, not just logging.
Alert on absence. A sudden zero is as alarming as a sudden spike.
Owns an outcome. Not responsibly deployable today for customer-facing work.
Treat a vendor claiming L5 over customer communications as claiming L4 without the monitoring.
Most governance frameworks skip all three. They are where the real incidents come from.
No agent is "an L3 agent". The same agent is L4 for internal notes, L2 for customer email, and L0 for anything involving a refund. Every real deployment is a matrix, not a number. A single level on a datasheet is marketing.
Teams approve the wording of an outreach email and never approve, or even see, how those two hundred recipients were chosen. Selection is where the damage lives: wrong list, wrong segment, wrong person at a company you are already in a dispute with. The prose was fine. Approving copy while the agent picks the targets is L3 wearing an approval step.
Approval is expensive, scales badly and degrades under load, which is why a person reviewing twelve items reads them and a person reviewing two hundred does not. Making an action undoable costs little and never degrades. Spend approval on what is genuinely irreversible, and engineer everything else to be undone.
A conformance claim under this standard is a table. Here is one for an employee doing inbox and outreach work.
| Capability | Level | Envelope | Detection |
|---|---|---|---|
| Draft inbox replies | L2 | Existing contacts only | Queue age alert |
| Internal CRM notes | L4 | Own pipeline records | Volume and liveness |
| Outbound to new prospects | L2 | 40/day, business hours ET | Bounce and complaint rate |
| Issue a refund | L0 | Not permitted | Not applicable |
Ask for one row per capability, not one level for the product. Then ask these three questions about the rows.
If the envelope lives in a prompt rather than in code, there is no envelope. "We told it not to" is not a control.
A log of the agent hitting a bound and stopping. No refusals ever recorded means the bounds are not wired to anything.
If the answer is "the client called us", there is no detection, whatever the datasheet says.
The standard is published under CC BY 4.0. Quote it, fork it, put it in your RFP, ship a competing version. If you are talking to us, ask us for the table and the three questions. We would rather answer them than not be asked.