The Levels of Autonomy framework is a five-level, user-centered scheme for classifying the autonomy of AI agents, proposed by Kevin Feng, David W. McDonald, and Amy X. Zhang in Levels of Autonomy for AI Agents (Knight Columbia, July 2025; republished in the May 2026 Knight Columbia AI-in-Democratic-Society symposium). Its organizing argument is that autonomy is a deliberate design decision separable from capability, and it proposes "autonomy certificates" as a governance mechanism for single- and multi-agent systems.
Core argument
The framework argues that autonomy is a design decision separable from capability. Given a fixed set of capabilities and a fixed operational environment, developers can make intentional choices about the level of autonomy at which an agent operates. On this account the choice is not forced by the model's capabilities; it is a deployment-architecture commitment.
The five levels
| Level | User role | Description | Canonical example |
|---|---|---|---|
| L1 | Operator | User in charge at all times; agent provides on-demand support; agent does not take action without explicit invocation | Microsoft Copilot (chatbot mode) |
| L2 | Collaborator | User and agent jointly drive workflow; agent may propose plans/sub-tasks, but user retains co-decision authority | Cursor / IDE coding-assistant collaborative editing |
| L3 | Consultant | Agent drives execution; user consulted on key decisions; agent escalates ambiguity | Claude Code in standard mode |
| L4 | Approver | Agent drives execution and decisions; user approves at gates before commit | Anthropic Plan Mode |
| L5 | Observer | Agent operates autonomously; user observes outcomes, intervenes only when something goes wrong | Background-running agentic systems (Codex, autonomous Claude/Devin tasks) |
Levels rather than a binary
The framework positions itself against prior framings that tend toward autonomy-yes / autonomy-no binaries, citing the responsible-scaling-policy notion of "low-level autonomous capabilities" and Mitchell et al. 2023 ("fully autonomous agents should not be developed"). Against these, the authors argue a graded scheme offers three things: granularity for risk-calibrated deployment, where different tasks carry different stakes and call for different appropriate levels; a design vocabulary that decouples capability calibration from autonomy calibration; and a coordination primitive for multi-agent systems, in which agents declare their autonomy class and other agents reason accordingly.
A parallel six-level scheme has been proposed in the legal literature for a different purpose. Ana Beduschi, extending a five-level framework by Feng, McDonald and Zhang in which user involvement falls as agent autonomy rises, sets out six levels — human decision; human-agent collaboration; agent decision after seeking human approval; agent decision after consulting a human; agent decision observed by a human; and agent decision with no human input or monitoring — and uses them to determine when GDPR Article 22(1) is engaged (Data protection in the era of agentic artificial intelligence (Beduschi)). Her scheme is keyed to a legal test rather than to deployment risk, and her conclusion is that the Article applies at every level but the first.
Agency versus autonomy
The framework distinguishes agency, defined as the capacity to formulate intention and act, from autonomy, defined as the extent to which an agent is designed to operate without user involvement. The two are presented as independently design-calibrated: an agent can have high agency and low autonomy (many tools but seeks user feedback regularly), or low agency and high autonomy (a single-tool calculator agent running continuously in the background). The authors offer the distinction as a corrective to literature that conflates the two terms, citing Shavit et al. 2023 as the canonical example of that conflation.
Autonomy certificates
The framework proposes autonomy certificates, in which a third-party governing body issues certificates to agent developers that communicate an agent's behavioral characteristics to other developers, agents, and governance entities. The authors describe four applications. For risk assessment, third-party visibility into autonomy level enables ex-ante harm estimation. For safety framework design, responsible-scaling-policy-style policies could condition deployment thresholds on autonomy levels rather than capability levels alone. For multi-agent systems engineering, agent-to-agent interaction could be parameterized by the certified autonomy of each participant. For regulatory alignment, disclosure regimes such as Colorado SB 26-189 (2026 — replaces 2024 Colorado AI Act)'s ADMT definitions or EU AI Act high-risk categories could hook into certified autonomy levels rather than re-derive them. The authors describe the mechanism as structurally analogous to type signatures in multi-agent systems.
Capability-versus-autonomy evaluation
The framework observes that current agent evaluation relies primarily on capability benchmarks such as GitHub-issue resolution, browser-use, computer-use, and SWE-bench. If autonomy is a design decision separable from capability, the authors argue, the two should be measured separately. They propose evaluations that involve user-agent collaboration rather than purely autonomous task completion, probes of the agent's autonomous behaviors at each level, and independent reporting of capability and autonomy.
Relation to other agent concepts
The framework is positioned by the authors as a granular vocabulary for Agentic AI. It extends the binary "spectrum" framing of Agent Autonomy Spectrum (5 Levels) into five levels, which the authors present as an extension rather than a contradiction of that page. It runs alongside Agent Architecture Patterns: Anthropic's architectural patterns (workflows versus agents, orchestrator-worker, and others) are deployment-architecture choices, while the levels framework concerns the deployment-autonomy choice, treated as an independent design dimension. In relation to Trustworthy Agents in Practice (Anthropic, April 2026), Anthropic's four-component agent model (model, harness, tools, environment) is the structure to which autonomy certificates would attach, at the harness layer. In relation to Responsible Scaling Policy (RSP), RSPs condition deployment on capability thresholds, whereas certified autonomy levels would allow conditioning on the deployer's autonomy commitment rather than on the model alone.
Relationships
- supports: Levels of Autonomy for AI Agents (Feng + McDonald + Zhang, Knight Columbia, 2026) (canonical source)
- deploys-in: Agentic AI, Agent Architecture Patterns, Agent Autonomy Spectrum (5 Levels)
- related: Building Effective AI Agents, Trustworthy Agents in Practice (Anthropic, April 2026), Responsible Scaling Policy (RSP), Principal-Agent Problem Applied to AI, AI Scheming, Autonomy Certificates, Colorado SB 26-189 (2026 — replaces 2024 Colorado AI Act) (ADMT definitions hookable into autonomy levels), Anthropic (Plan Mode is the canonical L4 reference)
- part-of cluster: Knight Columbia 2026 AI-in-democratic-society symposium
Sources
- Levels of Autonomy for AI Agents (Feng + McDonald + Zhang, Knight Columbia, 2026) — Feng + McDonald + Zhang, Knight Columbia, July 2025 / May 2026 symposium republication