What Is Bounded Autonomy?

Bounded autonomy is the practice of giving an AI agent real independence inside a perimeter drawn in advance. Within the perimeter it chooses its own steps and tools; at the edge it must hand over to a person or stop. The perimeter is built from enforceable limits, such as an allow-list of tools, a spending cap or an approval rule, not from instructions in a prompt that the model is merely asked to follow.

Two ideas are often blurred here. The AWS agentic AI security scoping matrix (November 2025) treats agency as the scope of actions a system is permitted and enabled to take, and autonomy as how far it decides and acts without human intervention. Bounding works on both: fewer tools and narrower permissions limit agency, while approval rules and stop conditions limit autonomy. The EU AI Act assumes the dial exists, defining an AI system in Article 3(1) as one designed to operate with “varying levels of autonomy”.

The idea predates AI agents. A 2012 US Defense Science Board task force report on autonomy in defence systems wrote that in artificial intelligence autonomy “implies bounded independent thought and action”, citing Herbert Simon’s bounded rationality, and concluded that a machine’s independence is fixed by its designers. The same report argued against using levels of autonomy as a development roadmap, because one system can sit at different levels for different functions at the same moment. Military human-factors research has since used the term directly, for example in Jan Maarten Schraagen’s 2024 chapter Bounded Autonomy on responsible AI in military systems.

Several frameworks now grade agent autonomy, and they agree on the direction of travel: the more an agent may do alone, the stronger the controls around it must be. Gartner’s guidance of 26 May 2026 sets out four levels. An observe agent has read-only access and shows results only to whoever asked; an advise agent drafts and recommends while people carry out every action; an agent that may act with approval changes data, sends messages or alters settings only after a person approves each action; and an agent that may act autonomously operates inside guardrails, with people checking exceptions, audit logs and overall results rather than each decision. Gartner expects 40% of enterprises to demote or switch off autonomous agents by 2027, once production incidents expose gaps in their governance.

The AWS matrix grades systems by how much agency they hold. Scope 1, no agency, covers read-only systems that inform and recommend; scope 2, prescribed agency, can prepare changes that a person must approve; scope 3, supervised agency, may change its environment within set bounds without further approval once started; and scope 4, full agency, initiates its own work and runs with minimal oversight. Controls are mapped across six dimensions, from identity context and audit logging to agency perimeters and orchestration.

A third scale looks at the person rather than the system. In Levels of Autonomy for AI Agents (June 2025, revised July 2025), Feng, McDonald and Zhang argue that autonomy should be a deliberate design decision, separate from what a model is capable of, and grade it by how far the user’s part shrinks, from operating the agent to only observing it. They also propose AI autonomy certificates as a way to govern how agents behave, alone or in multi-agent systems.

Driving automation offers a familiar analogy, though only an analogy. SAE J3016 defines six levels, from no driving automation to full driving automation, and at levels 1 to 4 the automated feature is designed to work only within an operational design domain: the road types, speeds or weather it was built for. An agent’s bounds play the part of that domain, but agents have nothing comparable to the type-approval and safety-case regimes behind automated vehicles, so the comparison should not be pushed further.

Bounds fall into a handful of families, and a well-governed agent usually carries several at once. Task scope names the job, its inputs and when it is finished, so the agent cannot drift into neighbouring work. A tool allow-list names the tools the agent may call, with constraints on their arguments, and denies everything else. Data bounds set which sources it may read or write and under whose permissions, never wider than those of the person it acts for.

Budgets cap tokens, money, elapsed time and the number of steps or retries, which stops runaway loops as well as overspending. Action and value limits put a ceiling on what one action can do: a maximum payment, a maximum number of records changed, permitted recipients or a rate limit. Escalation rules say when the agent must hand over, for instance on low confidence, an out-of-policy request or behaviour outside its normal pattern; the hand-over patterns themselves are covered in the guide to human checkpoints for agents.

Termination combines stop conditions the agent checks for itself with an external kill switch it cannot override. Duration makes autonomy expire: credentials and grants that are bound to a time window or session, and permissions that lapse unless someone renews them. How tool and data permissions are granted and checked is the subject of the guide to AI agent permissions.

Whatever the kind, enforcement decides whether a bound is real. Singapore’s Model AI Governance Framework for Agentic AI, version 1.5 of 20 May 2026, tells organisations to “prefer deterministic rather than non-deterministic limits, and bound by design”: instead of telling an agent not to use a tool, make the tool impossible for it to call. Where a limit can only be probabilistic, such as a content filter, the framework suggests layering monitoring or human review on top, which is the job of AI guardrails.

Rules are starting to tie oversight to autonomy rather than to the technology alone. Article 14(3) of the EU AI Act requires the human oversight measures for a high-risk system to match its risks, its level of autonomy and its context of use, and for Annex III systems that duty begins on 2 December 2027, after the Digital Omnibus moved the original date. The guide to the AI Act for agentic systems explains when an agent falls into that category.

Singapore’s framework makes assessing and bounding risks the first of its four dimensions, and its case studies show what that looks like in a bank. OCBC’s private banking subsidiary, Bank of Singapore, built an agentic system to draft source-of-wealth memos from client documents; the agents are limited to narrow tasks such as extraction, drafting and checking, cannot start actions on their own and hold no decision authority, while designated reviewers validate and approve the result.

Proportionality cuts both ways. Gartner’s May 2026 guidance warns that identical controls for every agent either over-restrict simple agents, slowing delivery and pushing teams towards shadow development, or under-restrict autonomous ones. For a bank, insurer or public body, bounded autonomy is how an agent portfolio can be useful and defensible at once: each agent’s bounds are written down, approved by an owner, tested and logged. Where those bounds sit in a wider control framework is covered in the guide to agentic AI risk management.

Start from the task, not the model. For each action the agent could take, record its impact if wrong, whether it can be reversed, the tools and data it needs and the limit that fits; the result is a bound sheet that the agent’s owner and a risk reviewer can sign. New agents usually start in advise or act-with-approval mode and move up only when the evidence supports it.

Then test the bounds as an attacker would. Try to call a tool that is not on the list, exceed a value cap, read data outside the agent’s grant or keep running past its budget, and confirm that the platform, not the model, refuses. Agent evaluation on real cases shows whether the agent performs well inside its bounds; these tests show whether the bounds hold.

Widen the bounds one step at a time and only on evidence: a run of approvals passed unchanged, low error rates in sampled work and no incidents. Tighten them after an incident, a model upgrade or a new tool, and log every change with who approved it and why, so the history of an agent’s autonomy can be shown to an auditor.

How the three operating modes differ for an AI agent, with the nearest published levels checked on 6 November 2026.