Products now ask you to set an agent's autonomy directly. A menu offers to check in before each action, to let a second AI review the requests, or to run with full access. Most products default to somewhere in the middle, and the top setting usually comes with a warning. Picking a mode feels like a technical setting, but it's really a decision about how much of the task you're willing to stop watching.

The right answer depends less on how capable the agent seems and more on the task itself. What would a mistake cost, and who would pay for it? Can the action be undone, like a draft or a search, or is it a one-way door, like a sent email or a payment? Has this agent done this exact kind of work well before? Trust earned on research summaries says nothing about paying invoices. Answer those, and the places where it should stop and ask usually become clear.

Supervision can go wrong in the other direction too. Checking every step can cancel out the time an agent saves and train you to approve without reading. Good autonomy settings put your attention at the few points where a mistake would be expensive and let everything reversible run on its own.

Sizing up the stakes

Sizing up the stakes means asking what a mistake would cost on this specific task before deciding how much freedom the agent gets. The cost can land in several places: money, private data, a reputation, or other people who never agreed to be part of the task. A wrong line in a private notes file costs a few minutes to fix. A wrong message to a client or a wrong refund costs far more.

OpenAI's guide for teams building agents turns this into a quick rating. Each tool an agent can use gets a low, medium, or high risk score based on "read-only vs. write access, reversibility, required account permissions, and financial impact." [1] Anthropic gives a workplace example: an agent tasked with cutting wasted software subscriptions should get a person's approval "before it starts cancelling subscriptions or downgrading service tiers." [2]

Neither rubric asks how smart the agent is. Researchers Feng, McDonald, and Zhang argue that autonomy "is a property that can also be designed independently of capability." [3] Anthropic's documentation for Claude Code, its coding agent, follows the same logic, recommending its most hands-on mode for sensitive work and full autonomy only for isolated, sealed-off computer environments [4]. A very capable agent can still deserve a short leash on a task where one slip reaches a customer or a bank account.

Reversible vs. irreversible actions

Reversible vs. irreversible actions

Some agent actions can be taken back, and some can't. In his 2015 letter to shareholders, published in April 2016, Amazon founder Jeff Bezos called these two-way doors and one-way doors [5]. A two-way door can be walked back through: a draft can be rewritten, a search rerun, and an edit to a copy thrown away. A one-way door can't. Once an email is sent, a payment made, or a post published, there's no getting back to where things were. Bezos was writing about business decisions, but the split maps neatly onto what agents do.

Deleting a file is the obvious one-way door, but it's far from the only one. OpenAI's guide for agent builders says actions that are "sensitive, irreversible, or have high stakes should trigger human oversight until confidence in the agent's reliability grows," with examples like canceling orders, authorizing large refunds, and making payments [6]. In Anthropic's February 2026 analysis of agent activity, only 0.8% of actions appeared irreversible, such as "sending an email to a customer." [7] That sample leaned heavily on coding work, so agents that email, book, and buy may meet these doors more often.

The practical move is to sort a task's actions before handing it over. Reading, searching, and drafting can usually run freely. Sending, paying, publishing, deleting, and accepting terms are the doors where a person should stay involved. Some actions sit in between. An email to a client can be followed by a correction, but it can't be unread, so it's safest to treat these nearly irreversible actions as one-way doors too.

Checkpoints along the way

Checkpoints along the way

A checkpoint is a planned pause where the agent stops, shows where things stand, and waits for a person before going on. Anthropic described this pattern in its December 2024 guide to building agents, which has agents pausing for human feedback at checkpoints or when they hit a blocker [8]. Nielsen Norman Group calls the most important pauses decision gates: moments when the agent asks for confirmation before an action with serious consequences. In its August 2025 test of ChatGPT agent booking a restaurant, the agent handed control back for personal details and asked before submitting the reservation [9].

Checkpoints work best when they're chosen before the task starts. The same Nielsen Norman Group review warns that "there's no guarantee that the agent will correctly identify these situations to begin with." [10] OpenAI's guide suggests stopping when the agent goes past a set number of failed attempts or reaches a high-risk action [11]. Both are easier to set in advance than to hope the agent notices on its own.

Placing checkpoints is a balancing act. Anthropic puts the trade-off plainly: "An agent that stops at every possible question will give up most of the autonomy that makes it useful." One that always pushes through risks misreading what the person really intended. [12] Good checkpoints sit where a mistake would be expensive, not at every step.

Watching vs. walking away

Background agents take a task, work on it in their own space in the cloud, and report back when they're done. Cursor's Cloud Agents, formerly called Background Agents, run on separate virtual computers so several can work at once [13]. Anthropic's Claude Cowork, launched for non-developers in January 2026, describes scheduled tasks that run "unattended." [14] The alternative is watching live. ChatGPT agent, launched in July 2025, had a Watch Mode that required active oversight for critical tasks like sending emails [15].

The choice comes down to what the task touches. Contained work that's easy to undo, like researching a topic or drafting a document, suits walking away and reviewing the result at the end. Live actions on real accounts, like sending messages or making payments, call for a person nearby at the moments that count. In the terms of the autonomy slider, walking away puts the person in the approver role, stepping in only for blockers and consequential actions.

Watching has limits of its own. In 1983, Lisanne Bainbridge pointed to vigilance studies showing that people can't keep effective attention on a display where little happens for more than about half an hour [16]. Spotting a problem also requires knowing what it looks like. When Anthropic's launch guidance asked Cowork users to watch for signs of prompt injection, meaning hidden instructions planted in content the agent reads, Simon Willison objected: "I do not think it is fair to tell regular non-programmer users to watch out for 'suspicious actions that may indicate prompt injection'!" [17] Watching helps most at a few chosen moments, not as a blanket safeguard.

Earning more autonomy

Trust in an agent works best when it's earned on the job. In 2004, human factors researchers John D. Lee and Katrina A. See defined trust in automation as "the attitude that an agent will help achieve an individual's goals in a situation characterized by uncertainty and vulnerability." [18] Their "agent" meant any automated system, decades before AI agents. The target they described is calibrated trust, which matches what the system can actually do. Too much trust leads people to rely on it where it fails, and too little leads them to ignore help that works.

In practice, that means starting a new kind of task on a short leash and loosening it as the agent builds a track record. Anthropic's February 2026 study of Claude Code found that new users let the agent approve all of its own actions in about 20% of sessions, rising to over 40% after 750 sessions, a gradual shift the researchers read as "a steady accumulation of trust." [19] Experienced users didn't stop supervising. They approved fewer steps in advance and interrupted more often when something went wrong.

Earned trust is specific. An agent that writes reliable research summaries hasn't proven anything about paying invoices. Lee and See also found that trust drops after failures, and that a fault in one part of a system didn't lower trust in other similar parts [20]. Trust can move in both directions, so a mistake on one kind of task is a reason to tighten the leash on that kind of task again.

When the agent has the logins

When the agent has the logins

An agent working inside a person's signed-in accounts acts as that person. It can send email from their inbox, buy with their saved card, and post under their name. Intro to Vibe Coding treated personal tools as low-stakes because mistakes mostly affect the builder, and its "Secrets, Logins, and Leaks" lesson covered protecting credentials in apps people build. An agent signed in to someone's accounts falls outside that low-stakes line, even when the task itself is personal.

OpenAI said as much at ChatGPT agent's July 2025 launch. Risk rises because the agent "can work directly with your data, whether it's information accessed through connectors or websites that you have logged it into via takeover mode." [21] Connectors are links to apps like email and calendars, and takeover mode let the person type passwords themselves so the agent never saw them. OpenAI also warned that a hidden instruction on a web page could push the agent into a harmful action on a site the person is logged into, a risk known as prompt injection.

The safest default is the narrowest access the task needs. Anthropic's guidance for computer use advises against giving the model access to sensitive data such as login information [22]. At its August 2025 pilot, Claude in Chrome blocked financial services sites and advised against "sites that involve financial, legal, medical, or other types of sensitive information." [23] Where possible, the agent works logged out or with only the login the task requires, not the person's main email, bank, or social accounts.

The cost of over-supervising

Every check on an agent's work costs time, and that time comes out of whatever the agent saved. OpenAI's GDPval study, published in October 2025, measured this on real professional tasks. Experts needed about 404 minutes on average to do a task themselves and about 109 minutes to review a model's attempt. As the authors put it, "When incorporating time to review and redo work, the payoff from using a model shrinks." [24] With an older model, GPT-4o, the routine of trying, reviewing, and fixing ran at less than half the speed of doing the work by hand. With GPT-5, it was about 1.39 times as fast, which saves roughly 28% of the time.

Ethan Mollick frames the decision to delegate around 3 variables: how long the task would take a person, how likely the AI is to succeed on a given attempt, and how long it takes to request, wait for, and evaluate its output [25]. For a task a person can finish quickly, his advice is to delegate only when success is very likely, because otherwise generating and checking drafts takes longer than just doing it.

Bezos's letter on one-way and two-way doors warned about the same trap inside companies: running reversible decisions through heavy process leads to "slowness, unthoughtful risk aversion, failure to experiment sufficiently." [26] For agents, attention is best spent at the one-way doors and on the final result, while reversible steps run on their own. Reflexive approvals also wear down the quality of review.