There are three levels: insight only, proposal with approval, and full automation. The choice is made per task and turns on two things, namely what a mistake costs and how stable the rules are. It is not a choice to be made once for the whole company.
A chief executive had a system set up that monitored competitors, wrote reports and sent the conclusions to the board without anyone reading them first.
It went fine for three months. Then came a pricing recommendation nobody could stand behind, and he shut the whole thing down. Back to spreadsheets.
The mistake was not using AI. The mistake was that no decision was ever made about what the system was allowed to do on its own. That decision gets made either way. If it is not made deliberately, it gets made by whoever configured the system.
The three levels
Insight only
The model analyses and presents. Humans decide everything.
It reads data, competitor reports and trends and says what it found. Then you take a position.
When: where the consequence of a mistake is serious and the situation calls for judgement. Acquisitions, divestments, redundancies, major investment, changes of direction.
An example. A company had to assess an acquisition and had the analysis cover finances, culture, technology and people. The conclusion was that it looked good financially, but that the culture was markedly different, and that a couple of key people would probably leave on a change of ownership.
Management used that to negotiate the price down and to build retention into the deal. The analysis supplied the basis. The decision about what they could live with was theirs.
Had the system acted on its own, that kind of nuance would never have reached the table.
Proposal with approval
The model does the work, a human approves the result.
When: where the task is semi-routine but still matters. Competitor monitoring, quarterly reviews, risk assessment, trend analysis.
An example. A company received a Friday summary of what competitors had done that week: new products, price changes, job postings revealing where they were investing. The marketing lead spent twenty minutes reading it and passing it on.
The value was not the time saved. It was that the board was never surprised.
Had it run at the first level, somebody would have had to build the analysis from scratch every Friday, and it would not have happened. At the third, nobody would have noticed if the quality slipped.
Full automation
The model acts within rules you defined and reports afterwards.
When: only where the task is highly routine, the consequence of a mistake is small, and the rules are stable.
An example. Daily collection: new job postings at competitors, price changes, public filings. Nobody discusses it, it simply runs, and each month there is a dataset somebody can use.
By hand it would be many hours a month, and half the time it would be skipped. That is exactly the kind of task where automation earns its place, because the boredom that makes people skip it does not exist.
How to choose
Two questions settle it. What does a mistake cost, and how stable are the rules?
| Task | Cost of a mistake | Stability of rules | Level |
|---|---|---|---|
| Acquisitions and divestments | Critical | Low | Insight only |
| Choice of direction | Critical | Low | Insight only |
| Quarterly review | High | Medium | Insight to proposal |
| Risk assessment | High | Medium | Insight to proposal |
| Competitor monitoring | Medium | High | Proposal to automation |
| Trend analysis | Medium | High | Proposal to automation |
| Data collection | Low | High | Full automation |
| Notifications | Low | High | Full automation |
The rule of thumb: high cost and a need for judgement gives the first level. Medium cost or routine gives the second. Low cost and stable rules give the third.
Note that this is not about how capable the model is. A better model does not move an acquisition decision down to the third level, because precision is not the problem. The problem is that the question is not analytical.
Set a ceiling, whatever the level
Regardless of level, there should be an upper limit on how much a system may do between two human looks.
It can be an amount, a number of runs, or a number of actions per month. The principle is the same as giving a marketing lead a budget: they run the detail, but the frame is agreed in advance.
If the system hits the ceiling, it waits for approval. That is not distrust. It is the mechanism that ensures a system starting to behave differently than expected gets noticed within a month rather than after a year.
The method
- List the strategic tasks. Analyses, reports, decisions, actions. Typically twenty to thirty.
- Rate the cost of a mistake for each: critical, high, medium or low.
- Assign a level using the table above.
- Set a ceiling per task. If in doubt, start tight. Loosening later is easy; tightening after a bad experience is not.
- Review monthly with one question: did the system do anything we would not have approved? If yes, the task drops a level.
Point five is missing from almost every setup. Without it you do not know whether the trust is warranted, only that nothing visible has gone wrong.
Back to the chief executive
He should have split the tasks up before starting. Data collection on full automation. Competitor monitoring with approval. Pricing recommendations at insight only, because a wrong price hits customers and earnings at the same time.
Then he would have had control where it mattered and the system would have had freedom where it did not. Instead he shut all of it down, which was a more expensive decision than the original mistake.
What a board should specifically demand of that kind of setup is in three things your board should demand, and what an agent can and cannot do at all is in what AI agents can actually do.
Why some limits cannot be switched off on our side
A security level that can be configured away gets configured away, usually by whoever is in a hurry.
In 360° Sprint, fields classified RESTRICTED are therefore bound to the node type and never sent to any AI provider. It is not a setting. Gate approval is likewise bound to a role on the organisation rather than to the individual user, so who can say yes is fixed.
Autonomy is not about holding AI back. It is about deciding where the human stands, while it is still a decision rather than a discovery.
Where autonomy fits the larger picture is covered in AI for business strategy.