AI Agent Autonomy Levels: Copilot, Supervised, Autonomous

AI agent autonomy has three levels, and one question sorts them: who approves the next step, and what happens when nobody answers. A Copilot proposes and you act, so nothing moves once you walk away. A Supervised agent acts by itself, but only through steps you wired before the run, and it waits at whatever gate its runtime ships. A Fully Autonomous agent picks its next action on a surface nobody enumerated, and the run advances with an empty chair in front of it. Every listing here is sorted by that scale, which disagrees with a lot of product pages.

The test, in two questions

Who chose the action the tool is about to take? A human chose it, or the model chose it from a list a human wrote, or the model chose it from a surface nobody could write down.

What happens if nobody answers? Nothing, or the run waits, or the run continues.

Neither question asks how strong the model is. Both are answerable in ten minutes with a terminal and a coffee break.

Copilot: nothing happens when nobody answers

A Copilot produces output. A person turns that output into an action. There is no next step to approve, because the tool never had the ability to take one.

LlamaIndex sits here. The unit of work it ships is a query returning grounded context or an answer. Its own human-in-the-loop pattern makes the case: a tool that needs a person calls ctx.wait_for_event(), emits an InputRequiredEvent, and stays suspended until something sends a matching HumanResponseEvent. You compose that pause, because the default is a result handed back to a caller.

Not a complaint. Retrieval is the job, and the expensive failure there is a wrong answer, not a wrong action.

Supervised: the agent acts, inside a list you wrote

A Supervised agent runs a loop and calls tools without asking every time. It is bounded because you enumerated the tools and tasks before the run, and because the runtime ships a documented way to stop it mid-flight.

LangChain is the clearest case, since the pause is a primitive rather than a pattern. LangGraph's interrupt() pauses graph execution and returns a value to the caller, persists state through the checkpointer, and halts until you resume with Command(resume=...). The documented approval pattern puts interrupt() inside the tool function, so send_email asks before it sends. A framework builds an indefinite pause into its runtime because it expects someone to be there.

CrewAI arrives by another route. A crew is a list of tasks with roles, goals and tools, and that list is the approval: the crew works through what you wrote, then stops, because it cannot add a task to itself. A task also takes human_input, described in CrewAI's task reference as whether a human should review the agent's final answer. It defaults to False, worth saying out loud rather than implying the gate is always on.

Browserbase is the odd entry, being infrastructure rather than a decision-maker. Its Session Live View hands a person a URL where they can watch, click, type and scroll inside a running session, and the docs name human-in-the-loop as a use case, including takeover mid-session. A vendor shipping a takeover control expects a human within reach of it.

Fully Autonomous: the model picks the next action, and the run advances

Fully Autonomous means the action surface is open. Nobody wrote the list. The model chooses a shell command, a click or a keystroke, and the only bound is a policy about what class of action is allowed.

Claude Code sits here, and shows why one binary can look like two levels depending on how you start it. The permission modes in Anthropic's own docs include default, which prompts for permission on first use of each tool, acceptEdits accepts file edits and common filesystem commands, auto auto-approves tool calls with background safety checks, dontAsk denies anything not pre-approved, and bypassPermissions skips prompts. Started in default, it behaves like a Supervised agent all day. The documented unattended path is claude -p "Run the test suite and fix any failures" --allowedTools "Bash,Read,Edit", and the surface underneath is a shell. The model writes the next command, and no list exists to check it against.

Hence the tie-break rule: classify a tool by the widest surface the vendor documents as a supported run, not by the mode you happen to launch in. A mode flag is one keystroke. It is also not a containment mechanism, which is the separate question of what Claude Code auto mode blocks and what it cannot see.

OpenAI Computer Use is the same shape with a screen instead of a shell. In the documented loop, the model returns an action such as a click, a type or a drag, your application performs it, you return a screenshot, and the model decides what comes next. The surface is every pixel the desktop can show.

OpenAI's guidance on that page asks you to keep users in control of purchases, data transmission, destructive changes and other hard-to-reverse actions, and notes that typing sensitive information into a form counts as transmission. That is the tell. A vendor telling you to add a confirmation step is telling you the loop does not have one.

How to classify a tool we have never listed

1. Give it a real task and leave for ten minutes. If nothing changed outside its own output, and nothing could have, it is Copilot. Stop here.
2. If something changed, write down every action it was able to take. If that list is finite and you wrote it, the ceiling is Supervised.
3. If you cannot write the list, because the surface is a shell, a filesystem, a desktop or a browser the model drives itself, the ceiling is Fully Autonomous.
4. Find the documented pause: an approval prompt, an interrupt primitive, a review flag, a live takeover. Record whether it is on by default, because an off-by-default flag is a capability and not a guarantee.
5. Read the marketing last, and let it lose. A tool that requires approval per step is Supervised whatever its marketing says.

Where the six listed tools land

The third column decides how new capability reaches an agent, and it moves independently of the first. MCP-native means the agent speaks the Model Context Protocol and can pick up a server it was never built against, the mechanism covered in what an MCP server is and how it works. OpenAI function-calling means capabilities arrive as schemas declared per request, and the practical choice between the two is set out in MCP versus function calling, and which one you actually need.

Claude Code is MCP-native and Fully Autonomous. LlamaIndex documents Model Context Protocol support and is Copilot. Neither predicts the other, which is why they are separate axes.

Why the label on the box disagrees with the test

"Autonomous" is sold as a capability claim, so any product with a loop reaches for it. "Copilot" is sold as a safety claim, so products with real reach avoid it. The word on the page tracks the buyer, not the runtime. A framework with a rich pause primitive gets called autonomous because the homepage says so, and a model driving a desktop with no enforced confirmation gets called safe because a docs page recommends one.

The test survives that because it asks about behaviour you can observe: an approval prompt, a shell, a run that kept going with nobody watching.

One caveat: this scale describes a tool's shipped behaviour, not the system you build with it. Wrap a Fully Autonomous agent in your own approval queue and your system is Supervised. Do that for anything touching money or production data.

Every listing here carries an autonomy value produced by this test, not by vendor copy. Read the Claude Code listing to see how permission modes change the answer.

Frequently asked questions

What are the three levels of AI agent autonomy?

Copilot, Supervised and Fully Autonomous. A Copilot produces output that a human turns into an action. A Supervised agent acts by itself, but only through tools and tasks a developer wired before the run. A Fully Autonomous agent chooses actions on an open surface such as a shell or a screen.

How do I know if an AI agent is really autonomous?

Give it a task, leave, and come back. If the run advanced with nobody at the keyboard, and you cannot write down the full list of actions it was able to take, it is Fully Autonomous. If it stopped at an approval prompt and waited, it is Supervised.

Does human-in-the-loop mean an agent is not autonomous?

It means the vendor expects a person to be present. A documented pause, such as an approval prompt or an interrupt primitive, is strong evidence of a Supervised design. Check whether the pause is on by default, because an off-by-default flag is a capability, not a guarantee.

Is Claude Code fully autonomous?

It depends on the permission mode, and this directory classifies it by the widest documented one. In the default mode it prompts before each new tool. Run non-interactively with pre-approved tools and the model picks its own shell commands, so the surface it acts on has no fixed list.