Every level below is defined by the same four questions: who initiates the work, who composes it, who decides it executes, and who monitors the result. Marketing language answers none of these; the taxonomy answers nothing else. One rule for reading it: levels are not grades. The right level is a property of the task, and most businesses should run different levels for different work, simultaneously and on purpose.
The six levels
| Who composes | Who approves execution | Who monitors | |
|---|---|---|---|
| L0 · Fully manual | Human | Human (implicit) | Human |
| L1 · Assisted drafting | Human, AI-accelerated | Human (implicit) | Human |
| L2 · Prepared actions | AI, from live context | Human, per action | Both, via audit trail |
| L3 · Conditional autonomy | AI | Rules; human on exceptions | Human owns the rule set |
| L4 · Supervised autonomy | AI | None pre-execution | Human, after the fact |
| L5 · Full autonomy | AI | None | Aggregate metrics only |
L0 · Fully manual
Software stores and displays; a human does everything.
No system composes, decides, or executes. Tools at this level are filing cabinets with search: the accounting package that holds invoices a human writes, the inbox that holds email a human answers.
- Criteria: Human initiates, composes, decides, executes, and monitors. Software contribution: storage, retrieval, arithmetic.
- Worked examples: Invoicing: the owner opens QuickBooks, types every line, and clicks send. Procurement: the ops manager writes each PO from scratch.
- Edge case: Templates and saved replies are still L0: the human selects and adapts them per use. Reuse is not autonomy.
L1 · Assisted drafting
AI suggests within a task a human is actively driving.
The human composes; AI accelerates composition in the moment: autocomplete, tone rewriting, template filling, a chatbot drafting a paragraph the human pastes and edits. The human remains the author, and the AI never touches the systems of record.
- Criteria: Human initiates and executes; AI contributes fragments on request. The AI has no standing access to business systems.
- Worked examples: Customer email: the owner writes a payment reminder with ChatGPT’s help, then sends it themselves. Order processing: a rep uses AI to rephrase a delay notice.
- Edge case: Using a general assistant heavily is still L1 however good the prompts are; the human carries the context in and the output back manually every time.
L2 · Prepared actions, per-action approval
AI composes complete actions from live context; a human approves every execution.
The system watches connected tools, prepares complete executable actions (the invoice with amounts filled, the reply drafted in-thread), and presents each with its evidence. Execution requires a human approving that specific action; there is no path around the gate. The human stops being the author and becomes the editor and gatekeeper.
- Criteria: AI initiates and composes from standing system access; human decides per action; system executes on approval; every action is logged with its approver.
- Worked examples: Invoicing: a drafted invoice cites the email thread where the price was agreed and posts only when approved. Procurement: the PO implied by a stock floor is prepared, and a person approves the commitment.
- Edge case: Bulk-approve buttons erode L2 toward L3 in practice: if reviewers approve fifty at a time unread, the gate is ceremonial. Honest L2 keeps review evidence-first and fast enough that reading stays real.
L3 · Conditional autonomy
Routine cases execute unattended inside explicit rules; exceptions route to a human.
A human defines the envelope (risk thresholds, amounts, counterparties, action types); the system executes within it and escalates everything outside it. The human no longer sees routine actions before they happen but has defined, and can audit, exactly what "routine" means.
- Criteria: AI initiates, composes, and executes within written rules; human handles escalations and owns the rule set; the boundary is inspectable.
- Worked examples: Customer email: order-status replies under no-dispute conditions send automatically; anything mentioning a complaint routes to a person. Invoicing: recurring fixed-amount invoices post unattended; variable ones queue for approval.
- Edge case: L3 is only as honest as its escalation triggers. If the system classifies its own edge cases poorly, it is L4 wearing L3’s label; test the boundary with adversarial cases before trusting it.
L4 · Supervised autonomy
The system runs a whole domain; humans monitor outcomes after the fact.
Within a domain (all customer support email, all reordering), the system acts without pre-execution review. Human involvement is retrospective: dashboards, sampling, intervention when metrics drift. This is the "human-on-the-loop" posture.
- Criteria: AI owns initiation through execution across the domain; humans audit outcomes and can suspend the system; individual errors reach counterparties before any human sees them.
- Worked examples: Order processing: a high-volume store’s routine confirmations, restocks, and standard refunds all run unattended, with a weekly sampled review. Procurement: auto-replenishment against par levels with monthly human audit.
- Edge case: The defining question for L4 fitness: can the business absorb the worst plausible action in this domain reaching a counterparty? For $30 refunds, usually yes. For contract sends, no, and putting them here is how the documented failures happen.
L5 · Full autonomy
No routine human involvement; the system handles even its own exceptions.
The system operates the function end to end, including edge cases, with humans involved only in setting objectives and reviewing aggregate results. Genuine L5 in business operations is rare and mostly confined to fully deterministic or fully reversible domains.
- Criteria: AI handles the full loop including exception recovery; human contact with individual actions is effectively zero.
- Worked examples: Spam filtering runs at L5 in nearly every business, and correctly. Payment-to-invoice matching on exact references approaches it. Customer-facing communication at L5 remains, on the current evidence, a liability generator.
- Edge case: Vendors describing L5 ambitions for money-touching or customer-facing work should be read against the incident record, not the demo.
Locate your own tools: the five-question self-assessment
For any tool touching a business function, answer these in order; the first "no" names the level.
- Does the system have standing access to your business tools, composing without you bringing it context each time? No → L0 or L1 (L1 if AI assists composition at all).
- Can any action execute without a human approving that specific action? No → L2.
- Is unattended execution bounded by rules a human wrote and can inspect, with exceptions escalating to a person? Yes → L3.
- Do humans review only outcomes (dashboards, samples) rather than any action pre-execution? Yes → L4.
- Does the system handle its own exceptions with no routine human contact at all? Yes → L5.
Then ask the fitness question per task, not per tool: what is the worst plausible action at this level, and can the business absorb it reaching a customer, a supplier, or the books? Where the answer is no, the task belongs at L2 or below, whatever level the tool can technically run.
Where existing tools sit, including ours
Applied honestly to the market: general assistants (ChatGPT, Claude) are L1 for business operations. Workflow builders (Zapier, Make, n8n) are L4 by default within the workflows you build, L2-L3 where you add approval steps and maintain them. Autonomous agent platforms (Lindy and peers) run L3-L4 by design. flo.space is L2 by default and L3 where you configure auto-approval rules for low-risk actions; it deliberately does not offer L4 or L5 for outbound actions. That is a design position, not a capability gap, and the taxonomy exists partly so positions like it can be stated checkably. If a task on your list is honestly L4-safe, a workflow builder is the better tool for it, and the sorting framework will tell you.
License, versioning, and citation
AAL v1.0, published July 28, 2026, released under CC BY 4.0: use it, adapt it, or argue with it in print, with attribution. Versioned changes will be logged on this page and in the public repository. Suggested citation: "AI Agent Autonomy Levels for Business Operations (AAL) v1.0, flo.space, 2026. https://flo.space/ai-agent-autonomy-levels". Stable anchors: #l0 through #l5.
Common questions
No, and the taxonomy is useless if read as a maturity ladder. The right level is a function of the task: reversibility, blast radius, and how much judgment lives outside the system. L5 is correct for spam filtering; L2 is correct for contract sends; L0 is correct for firing a client. Level-task fit, not level maximization, is the whole discipline.
Most do, and the honest description of any tool is a range with a default. A workflow builder is L4 by default and L2 where you add approval steps. flo.space is L2 by default and L3 where you configure auto-approval rules for low-risk actions. Ask vendors two questions: what is the default, and what is the ceiling.
It borrows the structure (who does what, when, and who monitors) and the discipline of criteria over marketing language. It differs where business operations differ from driving: reversibility varies per action rather than per journey, and the "environment" is your counterparties, who are humans reading what your system sends.
Yes: it is released under CC BY 4.0. Use it, adapt it, disagree with it in print; attribution to flo.space with a link is the only requirement. A suggested citation line is at the bottom of the page.
L2, running on your real work
Connect your tools read only and watch prepared actions queue with their evidence. The taxonomy is free either way.