Define autonomy levels for agent tasks

Unlock the complete study guide.

Bundled into the existing Developing in Agentic AI Systems premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

What an autonomy level is, and how the task class sets it
What the actions can reach: remote effects, disclosure, and workspace automation
Copilot CLI: the limits of the plan-mode boundary
Copilot CLI: how long autopilot keeps working
Copilot CLI: how much an allow-all grant opens
Copilot CLI: approvals that outlive the session
VS Code: what each session permission level changes
Approval fatigue: more prompts are not more oversight
Custom-agent profiles: reserving an agent for explicit human selection
Organizational policy: removing modes, reserving tools, and gating activation
VS Code agent sandboxing: the network retry path it leaves open
Cloud agent firewall: repository allowlists add to the organization's
Copilot managed settings: precedence is resolved per key
Generated output remains a draft owed review
Applied reasoning: choosing the narrowest control that meets the requirement

Requirement to control, and the choice that looks right but is not

Stated requirement	Control that meets it	What that control actually does	Tempting wrong choice
An approach must be agreed before any implementation begins	Copilot CLI plan mode, with a person approving the plan	Blocks project-file edits, patches and workspace-changing shell commands while allowing writes in its private planning workspace; approving the plan exits planning	`--plan --mode autopilot`, which creates a plan and transitions automatically without waiting for that approval
A planning session must not be able to mutate anything external	Restricted tools and permissions in addition to plan mode	Plan mode alone can still allow shell commands whose effects cannot be determined in advance, and calls to connected external or MCP tools	Relying on plan mode by itself, or attaching a write-capable deployment MCP tool to the planning session
The agent may keep working, but must not run on indefinitely	`--max-autopilot-continues`, an explicit continuation bound	Caps how many continuation messages Copilot CLI autopilot may send; it controls continuation, not privilege	Narrowing tool permissions, which changes what the agent may do rather than how long it may keep going
Low-risk actions may proceed, but sensitive calls must still prompt	VS Code Manual permissions	Uses the configured per-tool, URL and terminal approval settings rather than approving everything	Allow all, which auto-approves tool calls including potentially destructive ones
A person must resolve ambiguous choices while the agent runs	Any permission level that still surfaces questions to the user	Allow all removes permission dialogs but the agent can still ask clarifying questions	VS Code Autopilot (on the Agent Host), which auto-responds to questions that would otherwise wait for the user
Expanded autonomy is authorized for one task only	A session-scoped permission level from the VS Code picker	Changes the current chat session only	`chat.tools.global.autoApprove`, which applies across workspaces
Developers must not be able to enable bypass modes at all	`ChatToolsAutoApprove` policy, or Copilot CLI `permissions.disableBypassPermissionsMode`	Prevents global auto-approval and hides Allow all, Assisted permissions and Autopilot; the CLI policy suppresses allow-all startup options and slash commands	Telling developers to use Manual permissions, which leaves the stronger modes selectable
One named high-risk tool must always be human-approved	`ChatToolsEligibleForAutoApproval` for that tool	Forces manual approval for individual tools such as `execute/runInTerminal` or `web/fetch` while agents remain available	Disabling agent mode, which removes far more capability than the requirement asked for
Extension-contributed tools must be unavailable, MCP tools retained	`ChatAgentExtensionTools` set to `false`	Blocks extension-contributed language-model tools while built-in and MCP tools keep working	An MCP registry restriction, which governs a different tool source entirely
An agent must be selectable by a person but never chosen automatically	`disable-model-invocation: true` in the custom-agent profile, leaving `user-invocable` unchanged	Prevents automatic selection based on task context while manual selection remains	`user-invocable: false`, which removes the manual selection you meant to keep
AI features must stay off until an approved org identity resolves	`ChatApprovedAccountOrganizations`	Keeps AI features disabled until the user is signed in to an approved organization and account-level policy data has resolved - a fail-closed gate	Disabling agent mode, which removes agent execution but does not make chat or inline suggestions wait for an approved organization identity
Repositories must not be able to widen the agent's outbound network access (egress) through repository firewall settings	Organization Enable firewall set to Enabled, Recommended allowlist set to Enabled or Disabled, and Allow repository custom rules set to Disabled	Locks repository firewall enablement and the recommended allowlist, and prevents repositories adding custom allowlist entries; org entries apply everywhere and cannot be deleted at repository scope	A repository-level allowlist, which combines with organization entries rather than replacing them

Decision tree

Cheat sheet

Sensitive and production-critical tasks warrant human ownership
Context-heavy design work needs more human involvement
Resolve ambiguous requirements before granting execution autonomy
Local execution can still cause remote irreversible effects
Read-only work can still disclose sensitive context
Generated code remains a draft requiring human judgment
Repeated low-value confirmations can weaken oversight
Plan mode protects project files while allowing planning notes
Plan mode is not an absolute side-effect sandbox
Copilot CLI --autopilot continues work until the task is completed
Bound autonomous continuation with an explicit limit
Copilot CLI --allow-all grants tools, paths, and URLs, not tools alone
Choose how long an approval persists to match how long you mean to trust
Resetting permissions clears saved tool approvals for the current location
Plan-then-autopilot intentionally removes the planning approval checkpoint
Manual permissions preserves configured fine-grained approval rules
VS Code Allow all removes permission dialogs but keeps clarifying questions
VS Code Agent Host Autopilot auto-approves, iterates, and answers questions itself
Session permission levels have a smaller scope than global auto-approval
Enterprise cloud-agent restrictions form a baseline for organizations
Private MCP registry policy does not govern cloud-agent access
A VS Code policy can remove the broad auto-approval levels
Enforce human approval for selected tools without disabling all agents
Managed CLI policy can prohibit permission-bypass options
Human selection and automatic custom-agent selection are independent controls
Use the agent-mode policy when the authorized autonomy level is none
File edits can trigger side effects before source-control integration
A bring-your-own-key model does not guarantee Responsible AI output filtering
Sandbox enablement does not prohibit every permission-relaxing retry
Organization firewall settings decide whether repositories can widen outbound access
Block extension-contributed tools without removing built-in or MCP capabilities
Resolve effective managed policy per key rather than merging competing policy values
Gate AI activation on approved organization membership and resolved account policy

Unlock with Premium — includes all practice exams and the complete study guide.