Autonomy levels
ARRTECH products on five levels of AI autonomy.
What the five levels measure
The levels distinguish observation, investigation, delegated work and action. They help a team discuss the permissions and human decisions needed for each kind of work.
Levels
-
Observes.
Cyberdroid AI Detection, available now to select organizations, learns normal behavior and raises a finding when it changes.
-
Investigates.
Cyberdroid AI Investigation, in early access, investigates a Detection finding or SIEM alert and writes a case for an analyst to accept.
-
Works when approved.
In early access, an agent works on tasks an administrator approves, and a person accepts the result.
-
Acts by rule.
ARRTECH SIEM, DLP and SOAR run the team's rules and playbooks. SOAR pauses at each step the team marks for approval.
-
Acts independently.
The system chooses and runs its own actions.
Limits
Scale
This is ARRTECH’s descriptive scale for its products. The permitted operations and approvals in a deployment give each level its practical meaning.
Rules
Review and test policy and playbook changes before production use, including their permissions and failure handling.
Standards
Naming a clause is not a claim of certification.
OECD
The OECD's AI incident reporting framework asks for a system's maximum autonomy level. Each product has one here.
OWASP
LLM06:2025, Excessive Agency, is more permission or autonomy than a task needs.
NIST
AI RMF MAP 2.2 asks how people use and review output. This page answers it.
