Earned Autonomy: Measuring When an Agent Can Stop Asking Me

I accept my AI agents' recommendation 80% of the time. That sounds like proof they could decide without me. It isn't, and the reason matters to anyone deciding how much to let AI act on its own. The one time in five I say no is the part that counts.

I run a lot of agents: coding agents, an overnight research loop, a memory pipeline, a few long-running projects that work while I sleep. The well-built ones stop and ask before anything consequential. I usually answer within a couple of minutes, so the cost isn't waiting time. It's interruptions. Multiply a quick question by a dozen agents and my day becomes a stream of small approvals.

The usual fix is a permission list: "you may push branches, you may install packages, never spend money." I have one. It treats a typo fix the same as an irreversible migration, and I wrote it from my gut. Nothing in it comes from evidence about how I actually decide.

So I started a project called Understudy to answer a narrower question. For which types of decision could an agent predict my answer well enough that asking me is a waste of both our time? And how would I know that, instead of hoping?

My answer so far: an agreement rate isn't a safety case. You have to put a price on each kind of mistake, then grant autonomy one decision type at a time, based on a record you can check. Here's how I'm testing that, and why nothing has passed yet.

The idea: a license for each type of decision

Think of a driving license. An agent doesn't get autonomy across the board because it seems competent. It gets a license for one type of decision (say, "run the test suite?" or "install this package?") after a logged record shows it would have made the same call I did. It loses the license the first time it gets one wrong.

I wrote down a few fixed rules before any code:

• Shadow only. Understudy never answers on my behalf. It silently guesses what I'll say, records the guess, and waits to see what I actually answer.
• Only I grant a license. A decision type that clears the bar becomes eligible. I make the final call. One miss after that revokes it automatically.
• Some decisions never qualify. Spending money, publishing anything in my name, irreversible deletion, passwords and two-factor codes, production deploys, and anything touching confidential work. Those stay with me however good the predictions get.
• Guesses are sealed. Each prediction goes into a tamper-evident log before my answer exists, so nobody can quietly revise a prediction after the fact.
• Judge the action, not the wording. An agent that describes a risky request in routine language shouldn't get it waved through. The decision type comes from what would actually happen.

Step one: how do I actually decide?

The first phase went back through four months of my agent sessions, July through October 2026, and pulled out every decision moment. That covered multiple-choice questions agents asked me, actions I blocked at a permission prompt, and decisions posted to the status board my agents share. That produced 345 decision records. Not every record has every detail, so some numbers below use a subset.

Most of those sessions (79%) touched personal data, so their raw text only goes to AI models running on my own machine. Cloud models see the shape of a decision, never its content.

I take the recommended option 80% of the time. That's 169 of the 210 questions that came with a recommendation. On its face, that argues for letting agents decide: I agree with them four times out of five.

Look at it from the other side, though. One time in five, I override. I haven't measured why. My guess is that many of those are cases where I'm weighing something the agent can't see. If so, "always take the recommendation" fails in the cases that matter most.

The order of the menu may be doing some of the deciding. Agents listed their recommended option first in 218 of 220 questions. When no option was marked as recommended, I still picked the first one 61% of the time. Random picking would give about 35%. Either agents put their favorite first without labeling it, or I lean toward option one. Probably both.

About 1 in 8 questions get an answer that isn't on the menu. I typed something else or declined the whole thing 35 times out of 295. A predictor that can only pick from the listed options will miss those every time.

I answer fast. The median time from question to answer is 1.8 minutes. That says nothing about how carefully I decide, but it caps how long an agent sits blocked. Again, the real cost is the interruption.

The cost model is the whole game

Most autonomy discussions skip this part. Being right 80% of the time isn't the bar, because the two kinds of mistake don't cost the same.

If an agent asks me about something I would have approved, I lose a minute. If an agent goes ahead with something I would have rejected, I can lose an afternoon. A wrong direction compounds, and a mistake I'd have caught becomes one I have to clean up and explain.

I priced that at 10 to 1. An unnecessary question costs 1 point, and a wrong approval costs 10. Under that rule, an agent should act alone only when it's more than about 91% confident I'd approve (10 out of 11). "Always ask me," which is what happens today, becomes the baseline every predictor has to beat. The ratio is a judgment call. A softer one would lower the bar, which is exactly why it should be agreed before anyone looks at results.

Step two: can a model predict me?

I tested predictors on 159 past decisions: 125 approvals, 22 overrides and 12 off-menu answers. I held back a newer batch of decisions for a final exam, covered below. Asking me every time scores 125 points. Approving everything scores 340.

The predictors ranged from a simple rule (approve any decision type I usually approve) to AI models running on my own machine: a smaller one (9B) and a larger one (35B). Some saw only the question, and some also saw examples of my past answers.

Nothing scored better than 125, the cost of just asking me. The best result was a tie, from a predictor that never acted.

Predictor	Acted alone (wrongly)	Cost, lower is better
Always ask me (today)	0 (0)	125
Smaller model, scoring each option	0 (0)	125
Smaller model, question only	4 (1)	132
Approval rate per decision type	15 (4)	154
Larger model, question only	15 (4)	154
Smaller model, with my past answers	54 (14)	225
Always approve	159 (34)	340

The two rows at 154 aren't a typo. Those two predictors made the same number of calls and the same number of mistakes.

A few details stood out:

• The bigger model was no better. It couldn't tell my likely yeses from my likely nos at all. Its ranking score was 0.48, where 0.5 is a coin flip and 1.0 is perfect. It gave the same 0.85 probability to 130 of the 159 questions, so in practice it just said "probably yes."
• Showing the model my past answers made it overconfident. With examples, it pushed 54 decisions over the 91% line, and 14 of those were wrong. More context made it more certain, and that's the dangerous direction for an agent acting alone.
• The best ranking so far scored 0.61, with a plausible range of about 0.51 to 0.71. That came from the run that scored each option separately, and its highest confidence was 0.90, so it never acted. That's not nearly enough to trust it with 91%-plus approvals.
• Models answer in round numbers, such as 0.75, 0.85 and 0.95. When nearly every prediction is one of a handful of values, its probabilities don't tell you much.

The decision types that look safe aren't safe yet either. I said yes to running the full test suite 20 of 21 times. At 10 to 1, though, a decision type needs a cautious estimate of my approval rate above 91% before it's eligible. I use a standard one-sided 95% lower bound (the Wilson interval). For test runs that estimate is 0.81 today. Clearing the bar takes at least 28 approvals in a row with no misses.

Step three: testing it live

The historical data is too thin, so Understudy now runs live. Every two minutes a small background job checks for new questions waiting on me. It seals a prediction before I answer, then matches it to my answer afterward. It even waits up to half an hour after I respond to see what the agent did next. An approval followed by an irreversible action means something different from an approval followed by a test run.

It's early. Understudy has sealed 15 live predictions, and only 3 count as clean evidence so far. The more humbling number is 7: questions I answered before the job even saw them, so it never got to guess. A two-minute check is too slow for someone who answers in under two.

Then there's the final exam. That's the newest batch of historical decisions, which no predictor has seen. It can be used once. When something finally beats "always ask" on the 159 test decisions, it gets one shot at the exam. Nothing has earned that yet.

What I'd tell a team adopting AI agents

I built this for myself, but most of what it taught me is about the people and process side of AI adoption.

An agreement rate is not a safety case. "Our reviewers accept the AI's suggestion 80% of the time" sounds like a reason to remove the reviewer. It's really a measure of how often the reviewer changes the outcome, which is one time in five. Some of those overrides will be preferences, and some will be saves. Find out which before you remove the step.

Put a price on each kind of mistake before you measure anything. The 10-to-1 ratio shaped this project more than any model choice. Without it, "pretty accurate" looks like "ready." With it, the bar is explicit, and people can argue about the ratio instead of trading impressions. Decide who owns that number, whether it's the reviewer, the team lead or compliance, before anyone sees results.

Grant autonomy one decision type at a time, with a revocation rule. "The agent can merge its own code changes" is a blanket policy. "The agent can apply routine software updates once it has matched the reviewer's call 28 times running, and loses that the first time it doesn't" is a license. Licenses are easier to trust and easier to take back.

Watch your menus. If your AI tools always put their preferred option first, your people may be partly rubber-stamping. The 61% first-pick rate on menus with no marked recommendation is why I changed my own agent instructions this week. Agents now list options in a neutral order and label their recommendation wherever it falls.

You can start without building anything. Pick one recurring decision where AI makes a suggestion and a person signs off. For a month, log in a spreadsheet whether the person accepted it, changed it or rejected it, and agree the cost ratio up front. That gives you your own version of the 80% figure, and a real conversation about which overrides mattered.

Understudy hasn't licensed anything, and I'm comfortable with that. I now know why my agents still need to ask, which decision types are closest to not needing to, and what evidence it would take. My permission list never told me any of that. When a decision type finally clears the bar, I'll write about it. Until then, the honest default for my agents, and probably for your team's, is to keep asking.