AI Policy Wiki
Dashboard

Levels of Autonomy for AI Agents (Feng-McDonald-Zhang framework)

high confidence · updated 2026-08-02

Five-level user-centered framework for AI agent autonomy (operator, collaborator, consultant, approver, observer) proposed by Feng + McDonald + Zhang (UW, 2025). Argues autonomy is a deliberate design decision separable from capability. Introduces 'autonomy certificates' as a governance mechanism for single- and multi-agent systems.

The Levels of Autonomy framework is a five-level, user-centered scheme for classifying the autonomy of AI agents, proposed by Kevin Feng, David W. McDonald, and Amy X. Zhang in Levels of Autonomy for AI Agents (Knight Columbia, July 2025; republished in the May 2026 Knight Columbia AI-in-Democratic-Society symposium). Its organizing argument is that autonomy is a deliberate design decision separable from capability, and it proposes "autonomy certificates" as a governance mechanism for single- and multi-agent systems.

Core argument

The framework argues that autonomy is a design decision separable from capability. Given a fixed set of capabilities and a fixed operational environment, developers can make intentional choices about the level of autonomy at which an agent operates. On this account the choice is not forced by the model's capabilities; it is a deployment-architecture commitment.

The five levels

LevelUser roleDescriptionCanonical example
L1OperatorUser in charge at all times; agent provides on-demand support; agent does not take action without explicit invocationMicrosoft Copilot (chatbot mode)
L2CollaboratorUser and agent jointly drive workflow; agent may propose plans/sub-tasks, but user retains co-decision authorityCursor / IDE coding-assistant collaborative editing
L3ConsultantAgent drives execution; user consulted on key decisions; agent escalates ambiguityClaude Code in standard mode
L4ApproverAgent drives execution and decisions; user approves at gates before commitAnthropic Plan Mode
L5ObserverAgent operates autonomously; user observes outcomes, intervenes only when something goes wrongBackground-running agentic systems (Codex, autonomous Claude/Devin tasks)

Levels rather than a binary

The framework positions itself against prior framings that tend toward autonomy-yes / autonomy-no binaries, citing the responsible-scaling-policy notion of "low-level autonomous capabilities" and Mitchell et al. 2023 ("fully autonomous agents should not be developed"). Against these, the authors argue a graded scheme offers three things: granularity for risk-calibrated deployment, where different tasks carry different stakes and call for different appropriate levels; a design vocabulary that decouples capability calibration from autonomy calibration; and a coordination primitive for multi-agent systems, in which agents declare their autonomy class and other agents reason accordingly.

A parallel six-level scheme has been proposed in the legal literature for a different purpose. Ana Beduschi, extending a five-level framework by Feng, McDonald and Zhang in which user involvement falls as agent autonomy rises, sets out six levels — human decision; human-agent collaboration; agent decision after seeking human approval; agent decision after consulting a human; agent decision observed by a human; and agent decision with no human input or monitoring — and uses them to determine when GDPR Article 22(1) is engaged (Data protection in the era of agentic artificial intelligence (Beduschi)). Her scheme is keyed to a legal test rather than to deployment risk, and her conclusion is that the Article applies at every level but the first.

Agency versus autonomy

The framework distinguishes agency, defined as the capacity to formulate intention and act, from autonomy, defined as the extent to which an agent is designed to operate without user involvement. The two are presented as independently design-calibrated: an agent can have high agency and low autonomy (many tools but seeks user feedback regularly), or low agency and high autonomy (a single-tool calculator agent running continuously in the background). The authors offer the distinction as a corrective to literature that conflates the two terms, citing Shavit et al. 2023 as the canonical example of that conflation.

Autonomy certificates

The framework proposes autonomy certificates, in which a third-party governing body issues certificates to agent developers that communicate an agent's behavioral characteristics to other developers, agents, and governance entities. The authors describe four applications. For risk assessment, third-party visibility into autonomy level enables ex-ante harm estimation. For safety framework design, responsible-scaling-policy-style policies could condition deployment thresholds on autonomy levels rather than capability levels alone. For multi-agent systems engineering, agent-to-agent interaction could be parameterized by the certified autonomy of each participant. For regulatory alignment, disclosure regimes such as Colorado SB 26-189 (2026 — replaces 2024 Colorado AI Act)'s ADMT definitions or EU AI Act high-risk categories could hook into certified autonomy levels rather than re-derive them. The authors describe the mechanism as structurally analogous to type signatures in multi-agent systems.

Capability-versus-autonomy evaluation

The framework observes that current agent evaluation relies primarily on capability benchmarks such as GitHub-issue resolution, browser-use, computer-use, and SWE-bench. If autonomy is a design decision separable from capability, the authors argue, the two should be measured separately. They propose evaluations that involve user-agent collaboration rather than purely autonomous task completion, probes of the agent's autonomous behaviors at each level, and independent reporting of capability and autonomy.

Relation to other agent concepts

The framework is positioned by the authors as a granular vocabulary for Agentic AI. It extends the binary "spectrum" framing of Agent Autonomy Spectrum (5 Levels) into five levels, which the authors present as an extension rather than a contradiction of that page. It runs alongside Agent Architecture Patterns: Anthropic's architectural patterns (workflows versus agents, orchestrator-worker, and others) are deployment-architecture choices, while the levels framework concerns the deployment-autonomy choice, treated as an independent design dimension. In relation to Trustworthy Agents in Practice (Anthropic, April 2026), Anthropic's four-component agent model (model, harness, tools, environment) is the structure to which autonomy certificates would attach, at the harness layer. In relation to Responsible Scaling Policy (RSP), RSPs condition deployment on capability thresholds, whereas certified autonomy levels would allow conditioning on the deployer's autonomy commitment rather than on the model alone.

Relationships

Sources