Permission modes: graduated autonomy for AI agents
Permission modes are how an agent interface answers the only question users actually have: what is this thing allowed to do without me? Most products answer it once, at setup, with a wall of toggles nobody understands yet. The better answer is graduated autonomy — a small ladder of modes the user climbs as trust accumulates.
The ladder shows up in almost every serious agent product now, under different names. Strip the branding and it's four rungs.
The four rungs
Read-only. The agent can look but not touch: search the codebase, read the calendar, summarize the inbox. This rung exists to build the user's model of the agent — they watch what it would have done and calibrate. Products skip it because it feels weak. Users don't skip it; they start here mentally whether the product admits the rung exists or not.
Suggest. The agent produces the action but a human releases it: the drafted reply, the staged edit, the prepared refund. The critical design detail is that the artifact must be the real action in final form, not a description of it — "here's the email, send it?" builds trust; "I plan to reply politely" builds nothing. Suggest mode is where the agent earns its promotion, and the interface should make its track record visible: how many suggestions accepted, edited, rejected.
Auto with gates. The default destination for most users. The agent acts freely inside a boundary and stops at the boundary: edits files but asks before running commands, books meetings but asks before spending money, handles routine tickets but escalates angry ones. Everything about this rung lives or dies on how legible the boundary is. A user who can't predict which actions will pause doesn't experience "autonomy with safeguards" — they experience randomness.
Full auto, scoped. No pauses, but inside a hard sandbox: this repo, this budget, this calendar, this inbox label. The honest framing is that full auto is never actually full — the permission moved from per-action to the perimeter. The interface work shifts to the audit trail, because review is now retrospective.
The rules that make the ladder work
Per-domain, not global. Nobody trusts an agent uniformly. The same user wants full auto on formatting, gates on outbound email, and read-only on anything touching money. A single global mode slider forces the least-trusted domain to set the level for everything, which is why global sliders end up parked on the second rung forever. Model permission as a small matrix — domains down the side, rungs across — and default it conservatively.
Promotion is offered, never taken. The moment an agent widens its own permissions, trust resets to zero and doesn't come back. The interface may surface the case for promotion — "42 suggestions accepted unchanged this month; move email drafts to auto?" — but the click is the human's. This also produces the single most persuasive screen in the product: evidence of earned trust.
Demotion is instant and blameless. One click drops any domain a rung, no confirmation, no survey, no guilt-trip copy. Users experiment with autonomy only when retreat is free. Bury the demotion path and users respond rationally: they never promote in the first place.
Mode must be visible at the moment of action, not in settings. The chip that says what mode this agent is operating in belongs next to the work — on the draft, in the run header, on the diff. Settings-page-only permission state is how "wait, it can do that?" incidents happen. Nobody re-reads settings; everybody sees the header.
The boundary cases are the product. Any action the mode logic can't cleanly classify — a command that's usually safe but targets production, an email to a new external domain — should degrade one rung for that action alone. Downgrading a single weird action to suggest mode costs the user four seconds. Misclassifying it costs the deployment.
Why this converged
Graduated autonomy isn't a design fashion; it's the interface answer to a real constraint. Agents are capable of more than any user initially trusts, and trust grows only through witnessed behavior. A mode ladder turns that growth into interface state. Products that shipped agents without a ladder have been retrofitting one — usually after an incident — and products with a good ladder discover it is the onboarding: the path from spectator to delegator, one rung at a time.
The pattern connects to the wider standardization happening across the agent stack — protocols below the interface, mode conventions inside it. The tracker follows both layers as they move.