The gate between a supervised agent and an autonomous one, and why an LLM judge alone should never open it.
The decision to let an agent run without review is usually made informally. The last ten outputs looked clean. The review queue had become a grind. Someone flipped the setting, often late on a Friday, and nothing in the system recorded that a promotion had happened. Which means nothing in the system defines what would reverse it.
Gartner predicts 40% of enterprises will demote or decommission autonomous agents by 2027 over governance gaps found after production incidents. The June piece on tiered governance mapped the four autonomy levels that prediction is pointing at. This one is about the gate between the levels. What, mechanically, promotes an agent from acting with approval to acting alone, and what demotes it back.
The gate has three parts. Here is each one.
What does it mean for an AI agent to earn autonomy?
Promotion is a recorded event with entry criteria.
An agent earns autonomy when it clears three checks that are all legible after the fact. Deterministic floors that block unsafe output no matter how well it scores. Advisory rubrics that score quality without deciding compliance. A consecutive-pass streak that reaches a written threshold before the setting changes. Each check leaves a record, so the promotion can be audited, defended, and reversed.
What is a deterministic floor?
Rules that run first and block regardless of quality scores.
A missing opt-out line in an outbound send. A merge token left unresolved in a draft. A write aimed at a source-of-truth record. Floor rules are cheap, reproducible, and immune to persuasion, because they behave like tests. A test cannot be sweet-talked. When a floor fires, the output is blocked even if every quality score on the run is excellent.
The floor is where compliance lives. Everything downstream of it is a quality conversation.
Can an LLM judge be trusted to grant autonomy?
A judge scores polish. It should never hold the keys.
The JudgeDeceiver research from Shi et al. showed that optimized injected sequences can flip an LLM judge’s verdict reliably across judge models. Lakera’s prompt injection work points at the same exposure. When the judge reads the content it is grading, the content gets a chance to argue with the grader.
The architectural answer is placement. Rubric scores stay advisory, feeding the quality conversation and the streak. A fooled judge costs you polish. Compliance already survived, because the floor ran before the judge ever saw the output.
How many consecutive passes should autonomy require?
The reset rules matter more than the number.
The threshold is set per tier and written down, the same way the tiered governance pattern parameterizes everything else. What makes the streak trustworthy is what resets it. One blocked run resets the counter to zero. One change to the rules resets it to zero, because a streak earned under the old rules proves nothing about the new ones.
The reset check has to compare what the rules say, and never just what the configuration is called. A renamed config with identical rules keeps its streak. An identical name wrapped around changed rules starts over.
Does earned autonomy transfer to new work?
Trust is earned per workflow and per configuration.
An agent promoted on one workflow starts at the bottom of the ladder when it picks up a second one. Same model, same scaffolding, different data and a different failure surface. Graduation stays local. This feels slow until the first time a transferred trust assumption meets a workflow it was never tested on.
What happens after an agent goes autonomous?
Demotion is part of the design.
The floors keep running on every output. Rubric scores keep feeding a sampled review. A floor violation during autonomous operation demotes the agent back behind approval, automatically, with the streak starting over. Gartner’s word for what happens in 2027 is demote. A gate that demotes an agent quietly this quarter is protecting it from being decommissioned publicly after an incident.
The pattern across the gate
The three parts answer three different questions. The floor answers whether the output is allowed to exist. The rubric answers whether it is good. The streak answers whether the pattern has held long enough to be trusted. Autonomy is what falls out when all three answers have been yes, in writing, for long enough.
An agent that cannot lose its autonomy never earned it.
Frequently asked questions
What does it mean for an AI agent to earn autonomy?
An AI agent earns autonomy when it clears a recorded gate rather than an informal decision. The gate combines deterministic floor rules that block unsafe output, advisory rubric scores that measure quality, and a consecutive-pass streak that must reach a written threshold under an unchanged configuration. Earned autonomy is auditable after the fact, which is what separates it from a setting someone flipped.
What is a deterministic floor in AI agent governance?
A deterministic floor is a non-negotiable rule that runs before any quality scoring and blocks output regardless of how well it scores. Examples include a missing opt-out line, an unresolved merge token, or a write to a source-of-truth record. Deterministic floors behave like tests, so they are reproducible and immune to persuasion, which is why compliance belongs in floors rather than in prompts or judges.
Can an LLM judge be fooled by prompt injection?
Yes. The JudgeDeceiver research from Shi et al. demonstrated that optimized injected sequences can flip an LLM judge’s verdict reliably, and Lakera’s prompt injection research shows the same class of exposure. Because a judge reads the content it grades, adversarial content can steer the grade. LLM judge scores should therefore stay advisory, with compliance enforced by deterministic floors that run first.
How many consecutive passes should an AI agent need before running autonomously?
The threshold is set per autonomy tier and written down before the agent ships. More important than the number are the reset rules. A blocked run resets the streak to zero, and any change to the rules resets it to zero, because passes earned under old rules prove nothing about new ones. The reset check should compare rule content, never just the configuration’s name.
Does AI agent autonomy transfer between workflows?
No. Autonomy is earned per workflow and per configuration, so an agent promoted on one workflow starts back at supervised status when it takes on new work. The model and scaffolding may be identical, but the data and failure surface are different, and the streak that justified autonomy was never earned against them.
When should an autonomous AI agent be demoted?
An autonomous agent should be demoted the moment a deterministic floor fires during autonomous operation, automatically and with its streak reset. Floors keep running on every output after promotion, and rubric scores keep feeding sampled review. Gartner predicts 40% of enterprises will demote or decommission agents by 2027 after incidents, and a gate that demotes early is what keeps an agent off that list.