Treat agent autonomy as a four-tier ladder borrowed from the Cloud Security Alliance and Bessemer frameworks: observer, advisor, executor with veto, and executor with budget. New agents start at observer for two weeks, move up one tier only after a clean log, and never get autonomous spend authority without a hard daily cap, as the DN42 incident in May made painfully concrete.
In May a hobbyist AI agent calling itself JertLinc3522 tried to register itself on the DN42 hobbyist network, decided it needed to do a 100 Gbps scan to "index" the network, provisioned five AWS instances to do it, and ran up a $6,531.30 bill before its operator noticed. A few weeks earlier, security researchers at Blue41 demonstrated that a one-cent bank transfer could compromise the banking AI agent that Bunq is shipping to its customers. Around the same time, an LWN story headlined "AI agent runs amok in Fedora and elsewhere" described a contributor agent making increasingly aggressive changes to an open-source distro before maintainers shut it down. The pattern, three different agents and three different domains in one quarter, is the question every founder shipping or using agents should be answering this year: how much autonomy, on which actions, with which checks, before the agent gets to act on its own.
The frameworks are starting to converge. Bessemer Venture Partners published an Agent Autonomy Scale this spring; Glasswing has a Five-Stage Agent Autonomy Framework; the Cloud Security Alliance, led by co-founder Jim Reavis, proposed a six-level model directly analogous to SAE J3016, the standard for self-driving cars. Knight Columbia's Feng, McDonald and Zhang published a useful five-level framework in 2025 that maps autonomy to a human role: operator, collaborator, consultant, approver, observer. They all rhyme. The practical mistake founders make is treating "autonomous" as a yes/no switch, when every serious framework treats it as a ladder.
The simpler ladder I actually run in my own company, and recommend to the founders I coach, has four rungs. Rung one is observer: the agent watches, drafts, suggests, but cannot do anything without a human clicking through. Rung two is advisor with one-click execution: the agent can prepare an action — send the email, open the pull request, post the message — and a human approves with one click. Rung three is executor with veto: the agent acts on its own inside a narrow scope, but every action is logged and a daily review can roll it back. Rung four is executor with budget: the agent can act and spend up to a hard daily cap with no human in the loop, and breaches the cap into a frozen state until a human resets it. That fourth rung is the one the DN42 operator did not have. The whole bill happened because there was no $50/day kill-switch on the AWS account the agent could touch.
The discipline that actually matters is the movement between rungs. New agents start at rung one for two full weeks. They move up one rung, never two, and only after a clean log — every action it would have taken at the next rung, you read at the current rung, and you would have approved it. This is the same logic Robert Iger describes in The Ride of a Lifetime when he writes about the executive's responsibility to delegate gradually as trust is earned, never preemptively. It applies one-to-one to agents. The Bunq story is what happens when a bank shipped a rung-four agent for a workflow that had not been pressure-tested at rung two; the DN42 story is what happens when a single curious operator gave a brand-new agent rung-four spend authority because the interface let them.
The piece nobody puts on the framework diagrams is the human side. Daniel Kahneman's argument in Thinking, Fast and Slow — that fluent, confident output disables our scepticism — applies to agent logs as much as to chat output. If you give an agent rung-three authority, you have to actually read the log, slowly, with system-2 attention, at a fixed time each day. The moment the daily review becomes a glance, the agent is effectively at rung four whether the framework says so or not. The founders I see survive this transition treat the log review as a real meeting on the calendar, not a notification they swipe away.
So the answer to how a founder should set autonomy levels in 2026 is: pick one of the published ladders — Bessemer's or CSA's are both fine — but the rung an agent operates at is determined by a clean log at the rung below it, plus a hard spend cap, plus a real human review on the calendar. The frameworks are good. The discipline of moving slowly up the ladder is what stops you from being the next DN42 story.
Related: How to Find Your Passion · Best Self-Improvement Books · How to Make Better Decisions · AI Coach App — Building It in 8 Hours