Every team adopting AI agents eventually has the same argument. Someone wants the agent to do things — that was the point. Someone else wants a human to check everything — that was the condition. Both are right, and the argument is unresolvable as stated, because it treats trust as one decision.
Trust in an agent is not one decision. It is a decision per agent, per action category, revisited as evidence accumulates. That needs a mechanism, not a meeting. Here is the one we built into Oneop, offered as a model you can apply to any AI system — including ones that are not ours.
The three levels
Every agent gets a dial with three positions. The position determines what the action engine does when the agent proposes a write.
Level 1 — Suggest
The agent reasons, decides what it would do, and the proposal is logged as a notification. Nothing executes. Ever.
This is not a demo mode — it is the correct permanent setting for some work, and the correct starting setting for all of it. An agent at suggest is a tireless analyst: it surfaces the stale deals, drafts the replies, proposes the categorizations, and a person does the doing. You get most of the leverage and none of the write risk, and — critically — you accumulate a record of what the agent would have done, which is the evidence you need for the next level.
Level 2 — Approve
The agent’s proposed action becomes a real item in an approval queue. A person sees the action, the target record, and the agent’s full reasoning trace, and decides: dispatch or reject.
This is where most real operational value lives, and it is underrated because it sounds like bureaucracy. It is the opposite. An approval queue converts scattered judgment calls into a single review surface: instead of six interruptions a day, one queue worked twice a day. The human stays the decision-maker; the agent becomes the world’s most diligent preparer of decisions.
The mechanism has one non-negotiable requirement: the reviewer must see the actual reasoning, not a summary the agent wrote about itself. Oneop stores every step’s thought, chosen tool and observed result on the run, so approving is reading what happened, not trusting a précis.
Level 3 — Autonomous
The action dispatches without a human in the loop. The run — trigger, trace, action, outcome — is still fully recorded and reviewable after the fact.
Autonomy is earned per agent, not granted per platform. The promotion test we recommend:
- Reversibility. Could you undo this action class in one step? Tagging a record, creating a task, drafting into a folder: yes. Sending an email: no — a send cannot be unsent.
- Evidence. Has this agent run at approve long enough that you stopped rejecting its proposals? Your own approval history is the audit; if you were still correcting it weekly, it is not ready.
- Bounded blast radius. If it misfires ten times before anyone looks, what is the worst outcome? If the answer involves a customer or a ledger, stay at approve.
The fourth mechanism: locks the dial cannot turn
A three-level dial has a failure mode: someone turns it. The person configuring an agent at 6 p.m. on a Friday can set “autonomous” as easily as “suggest.”
So certain categories must be excluded from dispatch regardless of the autonomy setting. In Oneop, finance and stock actions — posting a bill, issuing a purchase order, sending a payment reminder, placing a credit hold — are refused by the action engine no matter what the dial says, unless a second, separate switch has been turned on for the workspace. Two independent decisions, made by different mechanisms, must align before an agent can touch money or inventory.
Design your own list by asking: which actions would I not delegate to a new employee in week one, even a brilliant one? That list is your category lock.
Guardrails are not autonomy, and you need both
Autonomy governs the output side — what happens to proposed actions. It does nothing about the input side: a prompt injection hidden in an email the agent reads, or customer PII flowing into a model call. Those need guardrails, and guardrails must not be optional.
In Oneop, prompt-injection blocking and PII redaction run on every model call, on every plan, with no off switch — a detected injection blocks the call outright. A second, configurable layer (tool allowlisting, action-value ceilings, confidence thresholds) is available on Pro and above and stays off until you ask for it. And every run operates under hard ceilings — six reasoning iterations by default with a cap of twelve, a 6,000-token budget, forty-five seconds, three actions — after which the run ends as escalated with the exit reason stored, rather than pushing on. The full picture is on the AI governance page.
One more rule: demos must not launder into audit trails
A governance model is only as good as its records, and records get polluted in a specific way: simulated runs. Any agent platform needs a demo mode; the danger is a demo indistinguishable from work.
Our rule: a simulated run makes no model call, consumes zero credits, reports no confidence score (a run that never asked a model has nothing to score — it renders as a dash), and is permanently badged Simulated next to every Live run. If you evaluate another system, ask how it makes this distinction. “The demo looks just like production” is a feature in a sales call and a defect in an audit.
Putting it to work: a 30-day pattern
- Week 1: Every agent at suggest. Read the proposals daily. You are calibrating, not saving time yet.
- Weeks 2–3: Move agents whose suggestions you kept agreeing with to approve. Work the queue twice a day. Track your rejection rate per agent — informally is fine; the run history is all stored.
- Week 4: Promote to autonomous only the agents that pass all three promotion tests, and only for reversible action classes. Everything touching customers or money stays at approve. Category locks stay locked.
The endpoint is not “everything autonomous.” A healthy steady state is a mix — some agents permanently at suggest, most at approve, a few earned autonomous — reviewed the way you would review any employee’s scope.
If you want to run this pattern on real software, Oneop’s AI agents implement every mechanism in this post, and the free plan is enough to run the whole 30-day exercise. Start at suggest. Let the evidence do the promoting.