A control model that lets security teams define how much independent action an AI system may take under different conditions. Instead of choosing between full automation and full manual review, teams set thresholds for approval, escalation, and containment based on risk, confidence, and asset sensitivity.
Expanded Definition
Adjustable autonomy is a governance pattern for agentic AI that defines how much independence an AI system may exercise before it must pause, seek approval, or be contained. It is not a binary switch between “manual” and “fully autonomous.” Instead, it creates graduated operating modes that can change by task, environment, confidence level, data sensitivity, or blast radius. In practice, adjustable autonomy sits at the intersection of AI governance, operational risk management, and security control design, which is why it maps closely to the NIST AI Risk Management Framework and the OWASP Agentic AI Top 10.
Definitions vary across vendors, but the security meaning is consistent: authority should expand or contract based on measured trust, not fixed hype-driven assumptions. A well-designed model can permit low-risk actions such as drafting a response, while requiring explicit approval for tool use that changes systems, secrets, or permissions. The most common misapplication is treating adjustable autonomy as a product feature rather than a control model, which occurs when organisations enable broad agent action without clear thresholds, rollback rules, or human escalation paths.
Examples and Use Cases
Implementing adjustable autonomy rigorously often introduces workflow latency and governance overhead, requiring organisations to weigh faster execution against tighter oversight and better containment.
- An AI service desk agent can resolve routine password reset requests, but must escalate any request that touches privileged access or identity proofing.
- A code-generation agent may open pull requests automatically, yet require human approval before merging changes that affect authentication, secrets handling, or production deployment.
- A security operations agent can enrich alerts and gather context from logs, but must stop short of taking disruptive response actions unless confidence and severity thresholds are met.
- A procurement assistant may summarise contract terms, while any action that sends data to third parties or modifies payment details remains approval-gated.
- An adversarially stressed AI workflow can be forced into a containment mode when signals align with known attack patterns described in the MITRE ATLAS adversarial AI threat matrix or emerging campaign reporting such as Anthropic’s AI-orchestrated cyber espionage campaign report.
These use cases work best when the autonomy level is tied to explicit policy conditions, not informal operator trust. The model can also be paired with CSA MAESTRO agentic AI threat modeling framework to align agent permissions with task risk.
Why It Matters for Security Teams
For security teams, adjustable autonomy is a practical control boundary around AI decision-making. Without it, agents can overreach, chain together low-risk steps into high-impact actions, or continue acting after their context has become stale or compromised. That creates governance gaps across identity, data access, and system change management, especially where an AI agent has access to secrets, admin APIs, or production tooling. The control objective is to constrain impact before an error becomes an incident, not to assume the model will self-regulate.
Adjustable autonomy also helps security leaders translate policy into operational enforcement. Teams can use the principle to define when an agent must defer to humans, when it may proceed under limited scope, and when it must be suspended entirely under zero trust conditions. The approach complements control thinking in NIST SP 800-53 Rev 5 Security and Privacy Controls, where authorization, monitoring, and incident response are treated as enforceable safeguards rather than abstract principles. Organisations typically encounter the need for adjustable autonomy only after an agent has made an unauthorised change, at which point the model becomes operationally unavoidable to contain the damage.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | Defines AI risk governance concepts that support graded human oversight for autonomy decisions. | |
| OWASP Agentic AI Top 10 | Addresses agentic application risks where excessive tool authority and missing guardrails are central. | |
| NIST CSF 2.0 | PR.AC-4 | Supports least-privilege and access restriction principles relevant to autonomous agent authority. |
| NIST SP 800-53 Rev 5 | AC-6 | Least privilege control aligns with limiting what an AI system may do independently. |
| OWASP Non-Human Identity Top 10 | Covers non-human identities that often execute actions through agent autonomy and delegated access. |
Treat autonomous agents as NHIs and bind their actions to scoped credentials and revocation paths.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
