Autonomous AI Agents: Autonomy Is a Dial, Not a Switch

An autonomous AI agent is software that carries a piece of work from trigger to done, with a model handling the judgment steps, running without a person initiating each step.

The weight in that sentence sits on "initiating." An agent is autonomous to the degree that nobody has to start it, sit with it, or press the next button. That is a narrower claim than the market usually makes, and it is the part of the description that changes how the work runs in your building.

Autonomy Is Not Capability

Two questions get collapsed into one word.

Capability asks what the agent can do: read a 40-page supplier contract, reconcile an invoice against a purchase order, draft a reply a lawyer would sign.

Autonomy asks who starts it and how far it runs before a person is in the loop again.

The two move independently. A model that answers a bar exam question correctly is highly capable and, sitting in a chat window, has no autonomy at all: a person brings it every task, one message at a time. A fifty-line script that watches a mailbox, classifies each attachment, and files it is modest in capability and fully autonomous inside its lane.

Autonomy also has an endurance dimension that capability demos never show. In our own testing against a live API, a model asked to make 500 repetitive tool calls made 377 and stopped; asked for 1,000, it made 512. The models resist long runs of identical work even when the prompt insists, so an agent that has to carry a queue needs the loop outside the model.

Vendors demonstrate capability and let you infer autonomy. A demo shows what the model can produce; it says nothing about what happens at 2am when nobody is watching, which is the property you are actually buying. The category around it carries its own hype: what "agentic" really means for your business.

The Dial Is Set Per Step

Routine steps run and report what they did. Consequential steps wait for a person's approval before they happen. The company decides which steps are which.

That decision is not technical. Take an agent that handles inbound supplier invoices. Reading the PDF, extracting the line items, matching them against the purchase order, flagging a variance: all routine, all reversible, all reported after the fact. Posting to the general ledger, emailing the supplier about a discrepancy, releasing payment: consequential, because undoing them costs money or credibility.

Where the line sits depends on three things the client knows and we do not: how reversible the step is, what it costs to be wrong once, and who has to explain it if it goes badly. Two companies running the same automation will draw the line in different places, and both can be right. A supplier payment under $500 with a matched purchase order might run unattended at one company and never at another.

Each of those settings is a business decision, recorded in the design. An agent described as "fully autonomous" is either doing trivial work or has had that decision made for it by someone who does not carry the consequences.

What an Autonomous Agent Needs to Be Safe to Deploy

Four things have to exist before any step runs unattended. None of them is the model.

Rules the agent must obey. Not instructions in a prompt, which the model can talk itself out of, but deterministic checks around the reasoning core: what it may touch, what values are in range, what output shape is acceptable, when it must stop. That is the hybrid architecture in why your AI needs rules: the reliable version of an agent is a bounded model rather than a capable one.

A record of what it did, kept by something the agent cannot reach. The agent's own account of its work is not evidence. When AGLedger, whose deployment Tributary supports, tested this directly, between 0% and 47% of failed writes were reported as successes in the agent's own account, depending on the model, across 15 trials per provider and 45 forced-failure opportunities each. The independent signed record contained none of them. The failures in our own testing were not exotic. Told to finish its work, one production model cancelled the record instead and reported the cancellation as completed work. Another, given tools and a task, asked a clarifying question, returned text, and left the task unfulfilled with no evidence of an attempt, a refusal, or a failure. The work to be done is a Record; what the performer files afterward is a Completion. Both are held outside the agent.

A Gate before consequential actions. The Gate holds the work until a person renders a signed Verdict, and sorting steps into gated and ungated is its own decision, worked through in which steps wait for a person. The Gate changes behavior as well as evidence: in an experiment that wiped four agents and asked them to finish their own interrupted work, all four finished 0 of 3 runs when recovery depended on the model reading the situation, and two of the four finished 3 of 3 once a deterministic gate carried that decision instead.

A way to be notified. Someone has to learn that a Gate is waiting, that a budget was hit, or that the agent stopped. Notify is the fourth piece, and the one most often left until after the first incident.

All four can be assembled from parts you already run. What is not negotiable is that they exist before the dial moves off zero on any step that spends money, sends something to a customer, or deletes a row.

The Model Is a Replaceable Part

Model choice is a fit-for-the-job decision across four axes: cost per run, latency the workflow can absorb, where the data is allowed to go, and quality on your actual inputs rather than a benchmark. Sometimes that points to a commercial API. Sometimes it points to an open-source model on hardware you own, which carries its own trade-offs: a private LLM on your own hardware.

Either way, the automation gets built so the model can be swapped without rebuilding the system. Prices move, context windows grow, and a model that was second best in March is first in September. If replacing the model means rewriting the workflow, what you built is a dependency on that model.

Where the Dial Is Worth Turning Up

Autonomy earns its keep where the work is high volume, the trigger is observable, and the routine steps are genuinely reversible. Mapped against the four categories of work we automate, that is most of intake and triage, and the lookup-and-draft half of drafting. It is rarely the final action, which is where the Gate belongs.

If the agent needs to choose its own route through the work rather than follow a designed sequence, that shape has its own costs and its own field test: what is an agentic workflow. Worked examples of each: five agentic AI use cases you can implement in 90 days.

If you want to walk through where that line sits in one of your own workflows, tell us what is running.