Law 44 · Humans & Autonomy
Match the Level to the Stakes
Full autonomy is a setting, not a default.
The principle
Autonomy is a spectrum — from 'the computer suggests' to 'the computer acts then tells you' to 'the computer acts and decides whether to tell you at all'. The highest levels are unwise for consequential actions because no aid is perfectly reliable and the cost of a confident error is unbounded. Autonomy isn't one switch; it's a dial you set per action by how reversible and costly that action is.
Why it happens
Sheridan and Verplank framed automation as a graded scale rather than an on/off switch, and Parasuraman, Sheridan, and Wickens later refined this into a framework where automation can be applied at different levels across four separable stages: acquiring information, analyzing it, deciding an action, and executing it. The key insight for consequential actions is that the right level is bounded by reliability and cost: because no aid is perfectly reliable, the appropriate level of automation falls as the cost of an error rises. A high autonomy level applied uniformly means the system executes irreversible actions at the same trust setting it uses for trivial ones, so a single confident error carries unbounded downside. The correct design is per-action, set by reversibility and blast radius, not a single global switch, which also sidesteps the opposite failure of forcing human confirmation on cheap reversible actions and breeding confirmation fatigue.
Watch for
- The agent uses one autonomy setting for everything, so resending a receipt and issuing a large refund run through the same path.
- Irreversible or high-cost actions execute before any human can see them.
- Humans are buried in approval prompts for trivial, reversible actions, training them to click through blindly.
In practice
Your support agent has one autonomy setting: act and report. That is fine when it is resending a receipt, but the same dial lets it issue a $4,000 refund and cancel an enterprise subscription before anyone sees it. The fix is not a global require-approval flag that buries humans in confirmations for trivial actions, it is gating per action by reversibility and blast radius. Let it resend receipts and reset passwords autonomously, route refunds over a threshold and any cancellation to propose-and-confirm, and you spend human attention only where a confident error actually costs you.
Apply it
- Classify each action by reversibility and blast radius before deciding its autonomy level.
- Let cheap, reversible actions run fully autonomously and gate costly or irreversible ones to propose-and-confirm.
- Tune the dial per action rather than flipping one global approval flag for the whole agent.
The takeaway
Don't pick one autonomy level for the whole agent. Gate irreversible or high-impact actions to propose-and-confirm, while letting cheap, reversible ones run fully autonomous.