The request usually arrives as one sentence: "Can the agent just handle the overdue invoices?" It sounds like a single setting, on or off. It is two. One is whether the agent may notice that an invoice needs attention and propose something, without anyone asking. The other is what it may actually do about it before a person signs off. Owners who treat those as one setting end up with either an agent that only answers when spoken to, or one that emails a client about an invoice that was paid yesterday.
"Autonomous" is two settings, not one.
An AI agent that acts without being asked involves two separate settings. Initiative is what it may notice and propose on its own. Authority is what it may do without a person's sign-off: it is granted per action, by how hard that action is to undo, and it decides where the human in the loop sits. You can grant a lot of the first and very little of the second.
The survey calls the first one proactiveness and keeps it apart from autonomy, which it reserves for the authority a person grants.[1] Its examples show the two moving independently. Smart-home platforms start a large share of interactions with very little authority behind any single act. Autonomous research systems run long, unsupervised loops, but on a question a person chose. One has plenty of initiative and little authority; the other has the reverse.
The initiative ladder, in an owner's words
The survey grades initiative on five rungs, by asking where the agent's task comes from.[1] A reactive agent does what it is told. A trigger-initiated one notices something that already happened and surfaces it. A forecast-initiated one acts on a need before it shows up. A mandate-directed one holds a standing objective and finds the work that advances it. An agenda-generative one rewrites the objective itself. The higher the rung, the more of the work the agent finds rather than receives.
Authority is granted per action, not per agent
The second setting runs from "suggest only", through "act inside a gate" (a draft, a sandbox, an approval step), to "act unsupervised". The mistake is to set it once for the whole agent. One agent can read anything, write drafts freely, and still need a signature before any message leaves the building. That is the same move as keeping an agent's reads apart from its writes, which our ad-account note walks through.
Where security, healthcare and law have landed.
The survey reads 13 application domains on both settings at once. In security, healthcare and law, the systems it covers sit at trigger-initiated to forecast-initiated initiative, and every consequential act goes through a gate: a review step, a clinician, an attorney.[1] Those fields, with education, converge on what the survey calls "mandate-directed initiative under bounded authority": the agent notices, investigates and prepares more, while anything consequential still needs a person. The survey's own line: "The frontier in these domains is the quality of initiative, not the scope of unsupervised authority."[1]
No domain it surveys has reached the top rung, where an agent rewrites its own objectives, and several argue it should not. Across domains, the survey's reading is that what is spreading is "not autonomy but initiative that a principal can safely accept", with the gate built before the initiative is granted.[1]
For a small business this settles the default. "It drafts, you send" sounds timid. It is where the fields with the most at stake have landed. When the track record earns more, authority grows action by action; our build-order note covers when an agent has earned it. What this note adds is that autonomy was never a single setting.
A worked example: the receivables watcher.
Take a 14-person Quebec services firm that bills by invoice, with about 120 invoices open at any time and a bookkeeper two days a week. The owner already spends 20 minutes on receivables every Monday morning. They want a "receivables watcher". Every number in this example is ours and illustrative.
Setting one: what it may notice
Walk the ladder with this firm. Reactive is a report: "list overdue invoices" when asked. Trigger-initiated notices that an invoice passed its due date and surfaces it. Forecast-initiated notices a client whose payments are slipping, three invoices each paid later than the last, before anything is overdue. Mandate-directed holds a standing objective, say "keep receivables under 45 days", and proposes work toward it, such as moving a chronic late payer to a deposit up front. Agenda-generative would rewrite that objective on its own, and nobody should be there. Grant this firm trigger-initiated through mandate-directed. Noticing and proposing cost the owner attention only, and the checks below are what control attention.
Setting two: what it may do, action by action
Now list every action the watcher could take and ask one question of each: can it be undone? The answer sets the authority. This is the table we write before an agent like this goes live.
| action | can it be undone? | authority |
|---|---|---|
| Read invoices and the bank feed | nothing to undo (read-only) | runs on its own |
| Add an internal note to the client record | yes, trivially | runs on its own (logged) |
| Put an item in the Monday digest | yes | runs on its own |
| Draft a reminder email | yes, it is a draft | runs on its own (draft only) |
| Send the reminder to the client | no, an email cannot be unsent | owner approves (each one) |
| Apply a late fee | partly: a credit note reverses the money, not the client's reaction | owner approves |
| Put the account on hold | hard to undo with the client | agent recommends, owner decides |
| Change payment terms or write off | no | never an agent action (the agent may only propose) |
Deployed agent products expose this setting as confirmation modes: the survey lists ask-always, ask-on-risk, allowlist and auto-execute.[1] It also flags the failure on the other side: confirmations that come too often breed approval fatigue, and a person who approves everything is no longer a safeguard. That is why the reversible rows run on their own and only the rows that leave the building, or cannot be taken back, ask. After a clean track record, one more row can move: a first, polite reminder to a client with a clean payment history could go out on its own. Authority grows one row at a time.
The default has a cost, and it is the owner's time. Every amber row is a decision someone has to make, and the survey is plain that human approval does not scale to high-volume operation.[1] Its answer for that case, a cheaper monitor watching a more capable agent, is still a sketch in the research. For a firm raising ten flags a week the cost is small. For one raising hundreds, revisit the authority table before the owner becomes the bottleneck.
Four checks before it acts unasked.
A worthwhile goal is not yet a reason to act. The survey breaks the decision into four checks, run in order, and gives each one its own way out.[1] Take one candidate act: the invoice for client B is 12 days overdue, $380. Send a reminder? In practice an act stops at the first check that says no; here we walk this one through all four to show what each catches.
The four checks, in the order the survey runs them, each with its fallback:
- Confidence: is the need real? If not sure, verify or ask.
- Value vs cost: is acting worth the interruption or the side effects? If not, drop, batch, defer or re-plan.
- Timing: is now the moment? If not, hold for the next breakpoint.
- Risk and reversibility: can it be undone if it is wrong? If not, draft it for approval, escalate, or refuse.
Is the need real?
Is the invoice actually unpaid? An e-transfer may have landed and not been reconciled, and the bank feed last synced two days ago. The fallback is to pull a fresh feed or ask the bookkeeper. The survey's warning here is that a model's own confidence score is not to be taken at face value, because neural networks are systematically miscalibrated.[1] It also cites a coding benchmark, FixedBench, where agents changed code even when the reported issue was already resolved, a bias toward acting that task-completion benchmarks do not penalize. "Already paid" is the receivables version of the same mistake. For a single missing input inside a task, our ask-or-guess note prices this check in detail.
Is it worth the interruption?
$380 against the owner's attention and the client relationship. The fallback here is to batch: anything under $500 goes into the Monday digest instead of a ping. The survey prices a suggestion in the user's attention and adds a cost that a single calculation misses: trust. Each flag can look worth it while the sequence wears out the owner's willingness to read them, the cry-wolf effect that drives people to stop using automation.[1]
Is now the moment?
The client has a delivery due Thursday, and a reminder lands better after they accept it. The survey's move is to reschedule rather than drop, and to ride a breakpoint the person already has: after the delivery, or at the Monday review.[1]
Can it be undone?
Sending is outward and permanent, so the reminder becomes a draft waiting in the owner's outbox: preview, then commit. Here the survey reports an unsettling finding: a gate can only act on a risk it perceives, and in emulated sandboxes, frontier agents routinely take high-stakes or irreversible actions, such as deleting data, without flagging them as risky. In the survey's words, "perception is the weak link".[1] So the veto cannot live in the agent's judgment. It has to be a permission the agent does not hold, not a sentence in its prompt. Our note on auditing an automation from one file shows where that permission belongs.
Silence is invisible. Make it legible.
When an assistant declines to answer a question, the survey points out, the refusal is visible. When a proactive agent decides not to act, nothing happens, and nothing is what you see.[1] That is why it adds a hold-and-monitor rung to the ladder of responses: keep watching without intruding. For an owner, that means a watcher that flags nothing on a quiet week looks exactly like one whose bank-feed credential expired on Wednesday.
Our recommendation, not the survey's finding: a one-line daily heartbeat. "Ran at 7:00, checked 118 invoices, nothing to flag." Silence then has a timestamp, and a missing line is itself the alert. It is the mirror case of an agent that keeps reporting while it has stopped working, which our stalled-agent note covers.
The number to watch: acceptance rate.
The survey names the metric that benchmarks of suggestion-type agents now use for the cost of interrupting someone: the share of the agent's unprompted suggestions that the person actually accepts.[1] It calls it precision. We call it acceptance rate, because that is what the owner sees. Here is the watcher's first six weeks, illustrative.
In weeks 1 and 2 the watcher raised 41 suggestions and the owner accepted 16, a 39% acceptance rate. The 25 rejections had three reasons, and each one points at a check. Eleven were already paid but not reconciled (check one). Eight were under $500 and not worth a ping (check two). Six were for clients in the middle of a delivery (check three). At the end of week 2 the firm made three changes: pull a fresh bank feed before flagging, batch anything under $500 into the digest, and hold flags for clients with an open delivery. In weeks 3 to 6 the watcher raised 39 suggestions and 30 were accepted, 77%.
Accepted suggestions stayed at about 7 to 8 a week the whole time, while flags fell from about 20 a week to about 10. Same useful work, half the reading. The rejection reasons are the valuable part: they tell you which check to tune. Counts this small swing from week to week, so read a rolling four-week rate. And keep it in proportion: the survey notes that measures which reward an agent for correctly staying silent are still scattered and specific to each field, so the owner computes this number for themselves; there is no industry standard to compare it with.[1]
One privacy note, because the watcher reads client names, amounts and payment history. Keep its read access to what the job needs, and keep the monitoring wherever your data-residency decision says it lives. The survey's own note on always-on monitoring points the same way: it describes edge-cloud splits that sanitize data on the device and keep sensitive monitoring local.[1] Under Quebec's Law 25 that posture is a decision to make on purpose, and our note on running AI on your own hardware walks through it. This is not legal advice.
What to set this week.
- List what it may notice.
Pick the rungs: which events it surfaces, which trends it forecasts, which standing objective it serves. Write the objective down in one line. That is the initiative setting.
- List every action, and ask "can it be undone?"
Read-only and reversible actions can run on their own. Anything that leaves the building, moves money or changes a client relationship waits for a person. That is the authority setting, one row per action.
- Default to suggest and prepare.
The agent drafts, you send. Put the veto in a permission the agent does not hold, not in its instructions: a guardrail written as a permission holds, one written as a sentence in a prompt does not.
target: no outward action without a person, until the track record says otherwise - Add a heartbeat.
One line a day saying the agent ran, what it checked and what it found. A missing line is the alert.
- Compute the acceptance rate monthly, and tune the check the rejections point to.
Log every suggestion and whether it was accepted, with a one-word reason when it was not. The reasons map to the four checks.
What this does not claim.
A survey, not an experiment. The source organizes published research and runs no new tests. The domain placements, the four checks and the findings we quote are the survey's reading of other studies, which we did not check against the originals.
Illustrative numbers. The firm, the invoices, the six weeks and every percentage in the worked example are ours, sized for a business like this one. Nothing here is a client record.
No standard for silence. The survey is explicit that benchmarks still largely hand the agent its work and score whether it finished, not whether it found the right work or correctly stayed quiet. Acceptance rate is a practical proxy until something better exists.
Not legal advice. The privacy paragraph describes a posture. What Law 25 requires of a particular business is a question for its counsel.
If you are about to give an agent a standing job, such as watching receivables, an inbox or a schedule, the contact form is the fastest way in. Tell us what it should notice and what it should never do on its own. Writing the per-action table with a client before an agent goes live is part of our assistants and agents work.